Exam (elaborations)
PCNSA Exam – Questions/Answers (Rated A+)
PCNSA Exam – Questions/Answers (Rated A+)
[Show more]
Content preview
PCNSA Exam – Questions/Answers (Rated A+)After making multiple changes to the candidate configuration of a firewall,
the administrator would like to start over with a candidate configuration
that matches the running-configuration.
Which command in Device>Setup>Operations would provide the most
operationally efficient way to accomplish this.
A. Import named config snapshot
B. Load named configuration snapshot
C. Revert to running configuration
D. Revert to last saved configuration Correct Ans - C. Revert to
Running Configuration
Starting with PAN-OS version 9.1, application dependency information is
now reported in which two locations. (Choose Two)
A. on the App Dependency tab in the Commit Status window
B. on the Policy Optimizer's Rule Usage page
C. on the Application tab in the Security Policy Rule creation window
D. on the Objects > Applications browser pages Correct Ans - A. On
the App Dependency tab in the Commit Status Window
C. On the Application tab in the Security Policy rule creation window.
What is the advantage for using application tags?
A. They are helpful during the creation of new zones.
B. They help with the design of IP address allocations in DHCP.
C. They help content updates automate policy updates.
D. They help with the creation of interfaces. Correct Ans - C. They
help content updates automate policy updates.
An Administrator wishes to follow the best practices for logging traffic that
traverses the firewall.
Which Log Setting is correct?
A. Disable all logging
B. Enable Log at Session End
,C. Enable Log at Session Start
D. Enable Log at both Session Start and End Correct Ans - B. Enable
Log at Session End
An Address object of type 'IP Wildcard Mask' can be referenced in which
part of the configuration.
A. Security policy rule
B. ACC global filter
C. external dynamic list
D. NAT address pool Correct Ans - A. Security Policy Rule
What is the function of application tags?
A. creation of new zones
B. application prioritization
C. automates referenced applications in a policy
D. IP address allocations in DHCP Correct Ans - C. automates
referenced applications in a policy
Which three types of authentication services can be used to authenticate
user traffic flowing through the firewalls data plane? (Choose three )
A. TACACS
B. SAML2
C. SAML10
D. Kerberos
E. TACACS+ Correct Ans - A. TACACS
B. SAML2
D. Kerberos
An administrator needs to create a Security policy rule that matches DNS
traffic within the LAN zone, and also needs to match DNS traffic within the
DMZ zone The administrator does not want to allow traffic between the
DMZ and LAN zones.
Which Security policy rule type should they use?
A. default
B. universal
,C. intrazone
D. interzone Correct Ans - C. intrazone
An administrator is reviewing another administrator s Security policy log
settings Which log setting configuration is consistent with best practices
tor normal traffic?
A. Log at Session Start and Log at Session End both enabled
B. Log at Session Start disabled Log at Session End enabled
C. Log at Session Start enabled Log at Session End disabled
D. Log at Session Start and Log at Session End both disabled Correct
Ans - B. Log at Session Start disabled Log at Session End enabled
Which type firewall configuration contains in-progress configuration
changes?
A. backup
B. running
C. candidate
D. committed Correct Ans - C. candidate
What are the two default behaviors for the intrazone-default policy?
(Choose two.)
A. Allow
B. Logging disabled
C. Log at Session End
D. Deny Correct Ans - A. Allow
B. Logging disabled
.Assume that traffic matches a Security policy rule but the attached
Security Profiles is configured to block matching traffic Which statement
accurately describes how the firewall will apply an action to matching
traffic?
A. If it is an allowed rule, then the Security Profile action is applied last.
B. If it is a block rule then the Security policy rule action is applied last.
C. If it is an allow rule then the Security policy rule is applied last.
, D. If it is a block rule then Security Profile action is applied last. Correct
Ans - A. If it is an allowed rule, then the Security Profile action is
applied last.
Palo Alto Networks firewall architecture accelerates content map
minimizing latency using which two components'? (Choose two)
A. Network Processing Engine
B. Single Stream-based Engine
C. Policy Engine
D. Parallel Processing Hardware Correct Ans - B. Single Stream-
based Engine
.You receive notification about new malware that infects hosts through
malicious files transferred by FTP. Which Security profile detects and
protects your internal networks from this threat after you update your
firewall's threat signature database?
A. URL Filtering profile applied to inbound Security policy rules.
B. Data Filtering profile applied to outbound Security policy rules.
C. Antivirus profile applied to inbound Security policy rules.
D. Vulnerability Protection profile applied to outbound Security policy
rules. Correct Ans - C. Antivirus profile applied to inbound Security
policy rules.
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/
security-profiles
An internal host wants to connect to servers of the internet through using
source NAT. Which policy is required to enable source NAT on the firewall?
A. NAT policy with source zone and destination zone specified.
B. post-NAT policy with external source and any destination address.
C. NAT policy with no source of destination zone selected.
D. pre-NAT policy with external source and any destination address.
Correct Ans - A. NAT policy with source zone and destination zone
specified
Which interface type requires no routing or switching but applies Security
or NAT policy rules before passing allowed traffic?
The benefits of buying summaries with Stuvia:
Guaranteed quality through customer reviews
Stuvia customers have reviewed more than 700,000 summaries. This how you know that you are buying the best documents.
Quick and easy check-out
You can quickly pay through credit card or Stuvia-credit for the summaries. There is no membership needed.
Focus on what matters
Your fellow students write the study notes themselves, which is why the documents are always reliable and up-to-date. This ensures you quickly get to the core!
Frequently asked questions
What do I get when I buy this document?
You get a PDF, available immediately after your purchase. The purchased document is accessible anytime, anywhere and indefinitely through your profile.
Satisfaction guarantee: how does it work?
Our satisfaction guarantee ensures that you always find a study document that suits you well. You fill out a form, and our customer service team takes care of the rest.
Who am I buying these notes from?
Stuvia is a marketplace, so you are not buying this document from us, but from seller Studyhall. Stuvia facilitates payment to the seller.
Will I be stuck with a subscription?
No, you only buy these notes for CA$34.78. You're not tied to anything after your purchase.
Can Stuvia be trusted?
4.6 stars on Google & Trustpilot (+1000 reviews)
74735 documents were sold in the last 30 days
Founded in 2010, the go-to place to buy study notes for 14 years now