[Mar 10, 2024] 100% Latest Most updated PCNSA Questions and Answers
Try with 100% Real Exam Questions and Answers
NEW QUESTION # 164
Given the topology, which zone type should zone A and zone B to be configured with?
- A. Virtual Wire
- B. Layer3
- C. Layer2
- D. Tap
Answer: B
Explanation:
Explanation/Reference:
NEW QUESTION # 165
What is the purpose of the automated commit recovery feature?
- A. It reverts the firewall configuration if the firewall recognizes a loss of connectivity to Panorama after the change.
- B. It generates a config log after the Panorama configuration successfully reverts to the last running configuration.
- C. It reverts the Panorama configuration.
- D. It causes HA synchronization to occur automatically between the HA peers after a push from Panorama.
Answer: A
NEW QUESTION # 166
Given the network diagram, traffic should be permitted for both Trusted and Guest users to access general Internet and DMZ servers using SSH. web-browsing and SSL applications Which policy achieves the desired results?
- A.
- B.
- C.
- D.
Answer: B
NEW QUESTION # 167
You need to allow users to access the office-suite application of their choice. How should you configure the firewall to allow access to any office-suite application?
- A. Create an Application Filter and name it Office Programs then filter on the business-systems category.
- B. Create an Application Filter and name it Office Programs, then filter it on the office programs subcategory.
- C. Create an Application Group and add Office 365, Evernote Google Docs and Libre Office
- D. Create an Application Group and add business-systems to it.
Answer: B
NEW QUESTION # 168
You receive notification about a new malware that infects hosts An infection results in the infected host attempting to contact a command-and-control server Which Security Profile when applied to outbound Security policy rules detects and prevents this threat from establishing a command-and-control connection?
- A. Vulnerability Protection Profile
- B. Data Filtering Profile
- C. Antivirus Profile
- D. Anti-Spyware Profile
Answer: D
Explanation:
Anti-Spyware Security Profiles block spyware on compromised hosts from trying to communicate with external command-and-control (C2) servers, thus enabling you to detect malicious traffic leaving the network from infected clients.
NEW QUESTION # 169
Which type of security rule will match traffic between the Inside zone and Outside zone, within the Inside zone, and within the Outside zone?
- A. interzone
- B. global
- C. intrazone
- D. universal
Answer: D
NEW QUESTION # 170
An administrator wants to prevent access to media content websites that are risky Which two URL categories should be combined in a custom URL category to accomplish this goal? (Choose two)
- A. known-risk
- B. streaming-media
- C. recreation-and-hobbies
- D. high-risk
Answer: B,C
NEW QUESTION # 171
An administrator needs to create a Security policy rule that matches DNS traffic within the LAN zone, and also needs to match DNS traffic within the DMZ zone.
The administrator does not want to allow traffic between the DMZ and LAN zones.
Which Security policy rule type should they use?
- A. interzone
- B. universal
- C. default
- D. intrazone
Answer: C
Explanation:
Explanation/Reference:
NEW QUESTION # 172
All users from the internal zone must be allowed only HTTP access to a server in the DMZ zone.
Complete the empty field in the Security policy using an application object to permit only this type of access.
Source Zone: Internal
Destination Zone: DMZ Zone
Application: __________
Service: application-default
Action: allow
- A. Application = "http"
- B. Application = "web-browsing"
- C. Application = "any"
- D. Application = "ssl"
Answer: B
Explanation:
http is not an application but service, the web-browsing cab be http/https.
NEW QUESTION # 173
Based on the show security policy rule would match all FTP traffic from the inside zone to the outside zone?
- A. intercone-default
- B. inside-portal
- C. internal-inside-dmz
- D. engress outside
Answer: A
NEW QUESTION # 174
Which object would an administrator create to enable access to all applications in the office-programs subcategory?
- A. application group
- B. HIP profile
- C. application filter
- D. URL category
Answer: C
NEW QUESTION # 175
Order the steps needed to create a new security zone with a Palo Alto Networks firewall.
Answer:
Explanation:
Explanation
Step 1 - Select network tab
Step 2 - Select zones from the list of available items
Step 3 - Select Add
Step 4 - Specify Zone Name
Step 5 - Specify Zone Type
Step 6 - Assign interfaces as needed
NEW QUESTION # 176
An administrator wishes to follow best practices for logging traffic that traverses the firewall.
Which log setting is correct?
- A. Enable Log at both Session Start and End
- B. Enable Log at Session End
- C. Disable all logging
- D. Enable Log at Session Start
Answer: B
NEW QUESTION # 177
Given the Cyber-Attack Lifecycle diagram, identify the stage in which the attacker can initiate malicious code against a targeted machine.
- A. Installation
- B. Exploitation
- C. Act on Objective
- D. Reconnaissance
Answer: B
NEW QUESTION # 178
Which type of security policy rule will match traffic that flows between the Outside zone and inside zone, but would not match traffic that flows within the zones?
- A. interzone
- B. intrazone
- C. universal
- D. global
Answer: B
NEW QUESTION # 179
Which option shows the attributes that are selectable when setting up application filters?
- A. Category, Subcategory, Risk, Standard Ports, and Technology
- B. Category, Subcategory, Technology, Risk, and Characteristic
- C. Name, Category, Technology, Risk, and Characteristic
- D. Category, Subcategory, Technology, and Characteristic
Answer: B
Explanation:
Explanation/Reference: https://docs.paloaltonetworks.com/pan-os/7-1/pan-os-web-interface-help/objects/objects- application-filters
NEW QUESTION # 180
An administrator notices that protection is needed for traffic within the network due to malicious lateral movement activity. Based on the image shown, which traffic would the administrator need to monitor and block to mitigate the malicious activity?
- A. north-south traffic
- B. perimeter traffic
- C. branch office traffic
- D. east-west traffic
Answer: D
NEW QUESTION # 181
Which Security profile would you apply to identify infected hosts on the protected network using DNS traffic?
- A. vulnerability protection
- B. URL traffic
- C. anti-spyware
- D. antivirus
Answer: C
Explanation:
In addition, you can enable the DNS Sinkholing action in Anti-Spyware profiles to enable the firewall to forge a response to a DNS query for a known malicious domain, causing the malicious domain name to resolve to an IP address that you define. This feature helps to identify infected hosts on the protected network using DNS traffic.
NEW QUESTION # 182
An administrator wants to prevent users from unintentionally accessing malicious domains where data can be exfiltrated through established connections to remote systems.
From the Pre-defined Categories tab within the URL Filtering profile, what is the right configuration to prevent such connections?
- A. Set the hacking category to continue.
- B. Set the Command and Control category to block.
- C. Set the phishing category to override.
- D. Set the malware category to block.
Answer: D
NEW QUESTION # 183
Place the following steps in the packet processing order of operations from first to last.
Answer:
Explanation:
NEW QUESTION # 184
Which action would an administrator take to ensure that a service object will be available only to the selected device group?
- A. uncheck the shared option
- B. ensure that disable override is cleared
- C. ensure that disable override is selected
- D. create the service object in the specific template
Answer: A
Explanation:
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/objects/objects-services
NEW QUESTION # 185
A website is unexpectedly allowed due to miscategorization.
What are two ways to resolve this issue for a proper response? (Choose two.)
- A. Review the categorization of the website on https://urlfiltering paloaltonetworks.com.
Submit for "request change", identifying the appropriate categorization, and wait for confirmation before testing again. - B. Identify the URL category being assigned to the website.
Edit the active URL Filtering profile and update that category's site access settings to block. - C. Create a URL category and assign the affected URL.
Add a Security policy with a URL category qualifier of the custom URL category below the original policy.
Set the policy action to Deny. - D. Create a URL category and assign the affected URL.
Update the active URL Filtering profile site access setting for the custom URL category to block.
Answer: A,D
NEW QUESTION # 186
......
New Palo Alto Networks PCNSA Dumps & Questions: https://www.ipassleader.com/Palo-Alto-Networks/PCNSA-practice-exam-dumps.html
Dumps to Pass your PCNSA Exam with 100% Real Questions and Answers: https://drive.google.com/open?id=1iNhBK4IVgQH22sHm_uF3VucZkDws_Iyg