Released Palo Alto Networks PCNSA Updated Questions PDF
PCNSA Dumps and Practice Test (219 Exam Questions)
Palo Alto PCNSA Exam Topics:
| Section | Objectives | Weight |
|---|---|---|
| Identifying Users | - Given a scenario, identify an appropriate method to map IP addresses to usernames. - Given a scenario, identify the appropriate User-ID agent to deploy. - Identify how the firewall maps usernames to user groups. - Given a graphic, identify User-ID configuration options. | 12% |
| Palo Alto Networks Security Operating Platform Core Components | - Identify the components of the Palo Alto Networks Cybersecurity Portfolio. - Identify the components and operation of Single-Pass Parallel Processing architecture. - Given a network design scenario, apply the Zero Trust security model and describe how it relates to traffic moving through your network. - Identify stages in the cyberattack lifecycle and firewall mitigations that can prevent attacks. | 22% |
| Securing Traffic | - Given a risk scenario, identify and apply the appropriate security profile. - Identify the difference between security policy actions and security profile actions. - Given a network scenario, identify how to customize security profiles. - Identify the firewall’s protection against packet- and protocol-based attacks. - Identify how the firewall can use the cloud DNS Security to control traffic based on domains. - Identify how the firewall can use the PAN-DB database to control traffic based on websites. - Identify how to control access to specific URLs using custom URL filtering categories. | 18% |
| Simply Passing Traffic | - Identify and configure firewall management interfaces. - Identify how to manage firewall configurations. - Identify and schedule dynamic updates. - Configure internal and external services for account administration. - Given a network diagram, create the appropriate security zones. - Identify and configure firewall interfaces. - Given a scenario, identify steps to create and configure a virtual router. - Identify the purpose of specific security rule types. - Identify and configure security policy match conditions, actions, and logging options. - Given a scenario, identify and implement the proper NAT solution. | 24% |
| Traffic Visibility | - Given a scenario, select the appropriate application-based security policy rules. - Given a scenario, configure application filters or application groups. - Identify the purpose of application characteristics as defined in the App-ID database. - Identify the potential impact of App-ID updates to existing security policy rules. - Identify the tools to optimize security policies. - Identify features used to streamline App-ID policy creation. | 20% |
NEW QUESTION 103
Which administrator type utilizes predefined roles for a local administrator account?
- A. Role-based
- B. Superuser
- C. Device administrator
- D. Dynamic
Answer: D
NEW QUESTION 104
Match each feature to the DoS Protection Policy or the DoS Protection Profile.
Answer:
Explanation:
NEW QUESTION 105
How many zones can an interface be assigned with a Palo Alto Networks firewall?
- A. four
- B. three
- C. two
- D. one
Answer: D
NEW QUESTION 106
Which interface type is part of a Layer 3 zone with a Palo Alto Networks firewall?
- A. Aggregation
- B. Management
- C. High Availability
- D. Aggregate
Answer: D
NEW QUESTION 107
Which two App-ID applications will need to be allowed to use Facebook-chat? (Choose two.)
- A. facebook
- B. facebook-email
- C. facebook-chat
- D. facebook-base
Answer: C,D
Explanation:
Explanation/Reference:
Reference: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClV0CAK
NEW QUESTION 108
You have been tasked to configure access to a new web server located in the DMZ Based on the diagram what configuration changes are required in the NGFW virtual router to route traffic from the 10 1 1 0/24 network to 192 168 1 0/24?
- A. Add a route with the destination of 192 168 1 0/24 using interface Eth 1/3 with a next-hop of 192.168
1.10 - B. Add a route with the destination of 192 168 1 0/24 using interface Eth 1/2 with a next-hop of 172.16.1.2
- C. Add a route with the destination of 192 168 1 0/24 using interface Eth 1/3 with a next-hop of
192.168.1.254 - D. Add a route with the destination of 192 168 1 0/24 using interface Eth 1/3 with a next-hop of 172.16.1.2
Answer: D
NEW QUESTION 109
Recently changes were made to the firewall to optimize the policies and the security team wants to see if those changes are helping.
What is the quickest way to reset the hit counter to zero in all the security policy rules?
- A. Highlight a rule and use the Reset Rule Hit Counter > Selected Rules for each rule
- B. Reboot the firewall
- C. Use the Reset Rule Hit Counter > All Rules option
- D. At the CLI enter the command reset rules and press Enter
Answer: C
Explanation:
References:
NEW QUESTION 110
Based on the show security policy rule would match all FTP traffic from the inside zone to the outside zone?
- A. intercone-default
- B. inside-portal
- C. internal-inside-dmz
- D. engress outside
Answer: A
NEW QUESTION 111
Match the Cyber-Attack Lifecycle stage to its correct description.
Answer:
Explanation:
Explanation
Reconnaissance - stage where the attacker scans for network vulnerabilities and services that can be exploited.
Installation - stage where the attacker will explore methods such as a root kit to establish persistence Command and Control - stage where the attacker has access to a specific server so they can communicate and pass data to and from infected devices within a network.
Act on the Objective - stage where an attacker has motivation for attacking a network to deface web property
NEW QUESTION 112
In the example security policy shown, which two websites fcked? (Choose two.)
- A. YouTube
- B. Facebook
- C. Amazon
- D. LinkedIn
Answer: B,D
NEW QUESTION 113
In which profile should you configure the DNS Security feature?
- A. Antivirus Profile
- B. Zone Protection Profile
- C. Anti-Spyware Profile
- D. URL Filtering Profile
Answer: C
NEW QUESTION 114
An administrator needs to allow users to use their own office applications. How should the administrator configure the firewall to allow multiple applications in a dynamic environment?
- A. Create an Application Filter and name it Office Programs, the filter it on the business-systems category, office-programs subcategory
- B. Create an Application Group and add Office 365, Evernote, Google Docs, and Libre Office
- C. Create an Application Group and add business-systems to it
- D. Create an Application Filter and name it Office Programs, then filter it on the business-systems category
Answer: A
Explanation:
Explanation
An application filter is an object that dynamically groups applications based on application attributes that you define, including category, subcategory, technology, risk factor, and characteristic. This is useful when you want to safely enable access to applications that you do not explicitly sanction, but that you want users to be able to access. For example, you may want to enable employees to choose their own office programs (such as Evernote, Google Docs, or Microsoft Office 365) for business use. To safely enable these types of applications, you could create an application filter that matches on the Category business-systems and the Subcategory office-programs. As new applications office programs emerge and new App-IDs get created, these new applications will automatically match the filter you defined; you will not have to make any additional changes to your policy rulebase to safely enable any application that matches the attributes you defined for the filter.
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/app-id/use-application-objects-in
-policy/create-an-application-filter.html
NEW QUESTION 115
The CFO found a USB drive in the parking lot and decide to plug it into their corporate laptop. The USB drive had malware on it that loaded onto their computer and then contacted a known command and control (CnC) server, which ordered the infected machine to begin Exfiltrating data from the laptop.
Which security profile feature could have been used to prevent the communication with the CnC server?
- A. Create an anti-spyware profile and enable DNS Sinkhole
- B. Create a URL filtering profile and block the DNS Sinkhole category
- C. Create an antivirus profile and enable DNS Sinkhole
- D. Create a security policy and enable DNS Sinkhole
Answer: A
Explanation:
Explanation/Reference: https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-web-interface-help/objects/objects-security- profiles-anti-spyware-profile
NEW QUESTION 116
A security administrator has configured App-ID updates to be automatically downloaded and installed. The company is currently using an application identified by App-ID as SuperApp_base.
On a content update notice, Palo Alto Networks is adding new app signatures labeled SuperApp_chat and SuperApp_download, which will be deployed in 30 days.
Based on the information, how is the SuperApp traffic affected after the 30 days have passed?
- A. No impact because the firewall automatically adds the rules to the App-ID interface
- B. All traffic matching the SuperApp_chat, and SuperApp_download is denied because it no longer matches the SuperApp-base application
- C. No impact because the apps were automatically downloaded and installed
- D. All traffic matching the SuperApp_base, SuperApp_chat, and SuperApp_download is denied until the security administrator approves the applications
Answer: B
Explanation:
Explanation
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/app-id/manage-new-app-ids-introduced-in-content-r
NEW QUESTION 117
Complete the statement. A security profile can block or allow traffic.
- A. before it is evaluated by a security policy
- B. on unknown-tcp or unknown-udp traffic
- C. after it is evaluated by a security policy that allows or blocks traffic
- D. after it is evaluated by a security policy that allows traffic
Answer: D
Explanation:
Explanation
Security profiles are not used in the match criteria of a traffic flow. The security profile is applied to scan traffic after the application or category is allowed by the security policy.
NEW QUESTION 118
......
The benefit in Obtaining the PCNSA Exam Certification
- Organization owners invest a lot in their employees when it comes to their training with the goal of making them quicker, more efficient, and more knowledgeable about their role. Certified Professional will reduce the time he spends on tasks, meaning he can get more done this could help reduce company downtime when repairing faults on a system or fixing hardware problems.
- Becoming Palo Alto Networks Certified Network Security Administrator means one thing you are worth more to the company and therefore more to yourself in the form of an upgraded pay package. On average an Palo Alto Networks Certified Network Security Administrator member of staff is estimated to be worth 30% more to a company than their uncertified professionals.
- After completion of Palo Alto Networks Certified Network Security Administrator Certification candidates receive official confirmation from Palo Alto that you are now fully certified in their chosen field. This can be now added to their CV, cover letters and job applications.
- When Candidates applying for a job or looking to promotion in their current position, an Palo Alto Networks Certified Network Security Administrator certification in the field in which Candidates are applying will put you at the top of the list and make them a desirable candidate for employers.
- Candidates will get in-depth knowledge by completing the courses along with the access to revision materials for 6 months upon completion means they will have a wider skill set when it comes to the various technologies and systems than an uncertified professional. Certified Professional in this particular skill set is 74% more efficient when it comes to completing their tasks in a timely well-executed manner.
Target Audience
The PCNSA certification is intended for anyone who is seeking to demonstrate an in-depth knowledge of Palo Alto Networks technologies, including the following IT professionals: system engineers, system administrators, system integrators, support specialists, as well as those clients who leverage Palo Alto Networks products.
PCNSA Exam Dumps Pass with Updated 2022 Certified Exam Questions: https://www.braindumpsvce.com/PCNSA_exam-dumps-torrent.html
Guide (New 2022) Actual Palo Alto Networks PCNSA Exam Questions: https://drive.google.com/open?id=10khG3A5Eeuz5tVe7zc9mqCYOV0h7g6Ag