What can be achieved by selecting a policy target prior to pushing policy rules from Panorama?

You can specify the firewalls m a device group to which to push policy rules

Doing so limits the templates that receive the policy rules

Doing so provides audit information prior to making changes for selected policy rules

You can specify the firewalls m a device group to which to push policy rules

You specify the location as pre can - or post-rules to push policy rules

An administrator would like to see the traffic that matches the interzone-default rule in the traffic logs.What is the correct process to enable this logging1?

Select the interzone-default rule and click Override on the Actions tab select Log at Session End and click OK

Select the interzone-default rule and edit the rule on the Actions tab select Log at Session Start and click OK

Select the interzone-default rule and edit the rule on the Actions tab select Log at Session End and click OK

This rule has traffic logging enabled by default no further action is required

Select the interzone-default rule and click Override on the Actions tab select Log at Session End and click OK

What is the correct process tor creating a custom URL category?

Objects > Custom Objects > URL Category > Add

Objects > Security Profiles > URL Category > Add

Objects > Custom Objects > URL Filtering > Add

Objects > Security Profiles > URL Filtering > Add

Objects > Custom Objects > URL Category > Add

The Palo Alto Networks NGFW was configured with a single virtual router named VR-1 What changes are required on VR-1 to route traffic between two interfaces on the NGFW?

Add a static routes to route between the two interfaces

Add zones attached to interfaces to the virtual router

Add interfaces to the virtual router

Enable the redistribution profile to redistribute connected routes

Add a static routes to route between the two interfaces

What is the main function of the Test Policy Match function?

ensure that policy rules are not shadowing other policy rules

verify that policy rules from Expedition are valid

confirm that rules meet or exceed the Best Practice Assessment recommendations

confirm that policy rules in the configuration are allowing/denying the correct traffic

ensure that policy rules are not shadowing other policy rules

An administrator has configured a Security policy where the matching condition includes a single application and the action is deny If the application s default deny action is reset-both what action does the firewall take*?

It sends a TCP reset to the client-side and server-side devices

It silently drops the traffic and sends an ICMP unreachable code

It sends a TCP reset to the server-side device

How are Application Fillers or Application Groups used in firewall policy?

An Application Filter is a dynamic way to group applications and can be configured as a nested member of an Application Group

An Application Filter is a static way of grouping applications and can be configured as a nested member of an Application Group

An Application Filter is a dynamic way to group applications and can be configured as a nested member of an Application Group

An Application Group is a dynamic way of grouping applications and can be configured as a nested member of an Application Group

An Application Group is a static way of grouping applications and cannot be configured as a nested member of Application Group

An administrator wishes to follow best practices for logging traffic that traverses the firewall Which log setting is correct?

Enable Log at both Session Start and End

Assume that traffic matches a Security policy rule but the attached Security Profiles is configured to block matching traffic Which statement accurately describes how the firewall will apply an action to matching traffic?

If it is an allowed rule, then the Security Profile action is applied last

If it is a block rule then the Security policy rule action is applied last

If it is an allow rule then the Security policy rule is applied last

If it is a block rule then Security Profile action is applied last

You have been tasked to configure access to a new web server located in the DMZ Based on the diagram what configuration changes are required in the NGFW virtual router to route traffic from the 10 1 1 0/24 network to 192 168 1 0/24?

Add a route with the destination of 192 168 1 0/24 using interface Eth 1/3 with a next-hop of 172.16.1.2

Add a route with the destination of 192 168 1 0/24 using interface Eth 1/3 with a next-hop of 192.168 1.10

Add a route with the destination of 192 168 1 0/24 using interface Eth 1/2 with a next-hop of 172.16.1.2

Add a route with the destination of 192 168 1 0/24 using interface Eth 1/3 with a next-hop of 172.16.1.2

Add a route with the destination of 192 168 1 0/24 using interface Eth 1/3 with a next-hop of 192.168.1.254

A Security Profile can block or allow traffic at which point?

after it is matched to a Security policy rule that allows traffic

on either the data plane or the management plane

after it is matched to a Security policy rule that allows or blocks traffic

before it is matched to a Security policy rule

Assume a custom URL Category Object of "NO-FILES" has been created to identify a specific website How can file uploading/downloading be restricted for the website while permitting general browsing access to that website?

Create a Security policy with a URL Filtering profile that references the site access setting of block to NO-FILES

Create a Security policy with a URL Filtering profile that references the site access setting of continue to NO-FILES

Create a Security policy with a URL Filtering profile that references the site access setting of block to NO-FILES

Create a Security policy that references NO-FILES as a URL Category qualifier, with an appropriate Data Filtering profile

Create a Security policy that references NO-FILES as a URL Category qualifier, with an appropriate File Blocking profile

Based on the screenshot what is the purpose of the group in User labelled "it"?

Allows users in group "it" to access IT applications

Allows users to access IT applications on all ports

Allows users in group "DMZ" lo access IT applications

Allows "any" users to access servers in the DMZ zone

Allows users in group "it" to access IT applications

An administrator is reviewing another administrator s Security policy log settings Which log setting configuration is consistent with best practices tor normal traffic?

Log at Session Start disabled Log at Session End enabled

Log at Session Start and Log at Session End both enabled

Log at Session Start disabled Log at Session End enabled

Log at Session Start enabled Log at Session End disabled

Log at Session Start and Log at Session End both disabled

Selecting the option to revert firewall changes will replace what settings?

the candidate configuration with settings from the running configuration

the running configuration with settings from the candidate configuration

the device state with settings from another configuration

the candidate configuration with settings from the running configuration

dynamic update scheduler settings

What is considered best practice with regards to committing configuration changes?

Disable the automatic commit feature that prioritizes content database installations before committing

Validate configuration changes prior to committing

Wait until all running and pending jobs are finished before committing

Export configuration after each single configuration change performed

What is the main function of Policy Optimizer?

convert port-based security rules to application-based security rules

reduce load on the management plane by highlighting combinable security rules

migrate other firewall vendors' security rules to Palo Alto Networks configuration

eliminate "Log at Session Start" security rules

convert port-based security rules to application-based security rules

How does an administrator schedule an Applications and Threats dynamic update while delaying installation of the update for a certain amount of time?

Configure the option for "Threshold"

Disable automatic updates during weekdays

Automatically "download and install" but with the "disable new applications" option used

Automatically "download only" and then install Applications and Threats later, after the administrator approves the update

Configure the option for "Threshold"

You receive notification about new malware that infects hosts through malicious files transferred by FTP.Which Security profile detects and protects your internal networks from this threat after you update your firewall's threat signature database?

Antivirus profile applied to inbound Security policy rules.

URL Filtering profile applied to inbound Security policy rules.

Data Filtering profile applied to outbound Security policy rules.

Antivirus profile applied to inbound Security policy rules.

Vulnerability Prote ction profile applied to outbound Security policy rules.

Palo Alto Networks PCNSA Practice Test 4 - Free Online Exam Prep & Questions

Question 1 / 40

Which statement is true about Panorama managed devices?

Panorama automatically removes local configuration locks after a commit from Panorama

Local configuration locks prohibit Security policy changes for a Panorama managed device

Security policy rules configured on local firewalls always take precedence

Local configuration locks can be manually unlocked from Panorama

Comment (0)

Palo Alto Networks PCNSA Practice Test 4

Question

Palo Alto Networks PCNSA Practice Tests

Practice Tests