PCNSA Online Practice Questions and Answers

Order the steps needed to create a new security zone with a Palo Alto Networks firewall.

Select and Place:

Which parameter is used to view the Security policy rulebase as groups?

A. Tags

B. Service

C. Type

D. Action

Given the image, which two options are true about the Security policy rules. (Choose two.)

A. The Allow Office Programs rule is using an Application Filter

B. In the Allow FTP to web server rule, FTP is allowed using App-ID

C. The Allow Office Programs rule is using an Application Group

D. In the Allow Social Networking rule, allows all of Facebook's functions

A Security Profile can block or allow traffic at which point?

A. after it is matched to a Security policy rule that allows traffic

B. on either the data plane or the management plane

C. after it is matched to a Security policy rule that allows or blocks traffic

D. before it is matched to a Security policy rule

An administrator is troubleshooting traffic that should match the interzone-default rule. However, the administrator doesn't see this traffic in the traffic logs on the firewall. The interzone-default was never changed from its default configuration.

Why doesn't the administrator see the traffic?

A. Logging on the interzone-default policy is disabled.

B. Traffic is being denied on the interzone-default policy.

C. The Log Forwarding profile is not configured on the policy.

D. The interzone-default policy is disabled by default.

For the firewall to use Active Directory to authenticate users, which Server Profile is required in the Authentication Profile?

A. TACACS+

B. RADIUS

C. LDAP

D. SAML

An administrator has configured a Security policy where the matching condition includes a single application and the action is drop.

If the application s default deny action is reset-both what action does the firewall take?

A. It sends a TCP reset to the client-side and server-side devices

B. It silently drops the traffic and sends an ICMP unreachable code

C. It silently drops the traffic

D. It sends a TCP reset to the server-side device

What are three characteristics of the Palo Alto Networks DNS Security service? (Choose three.)

A. It uses techniques such as DGA.DNS tunneling detection and machine learning.

B. It requires a valid Threat Prevention license.

C. It enables users to access real-time protections using advanced predictive analytics.

D. It requires a valid URL Filtering license.

E. It requires an active subscription to a third-party DNS Security service.

What is a recommended consideration when deploying content updates to the firewall from Panorama?

A. Content updates for firewall A/P HA pairs can only be pushed to the active firewall.

B. Content updates for firewall A/A HA pairs need a defined master device.

C. Before deploying content updates, always check content release version compatibility.

D. After deploying content updates, perform a commit and push to Panorama.

Which interface types are assigned to IEEE 802.1Q VLANs?

A. Tunnel interfaces

B. Layer 2 subinterfaces

C. Layer 3 subinterfaces

D. Loopback interfaces