During the packet flow process, which two processes are performed in application identification?(Choose two.)

pattern based application identification

application override policy match

pattern based application identification

application override policy match

application changed from content inspection

Refer to the exhibit. A web server in the DMZ is being mapped to a public address through DNAT. Which Security policy rule will allow traffic to flow to the web server?

Untrust (any) to DMZ (1.1.1.100), web browsing - Allow

Untrust (any) to DMZ (10.1.1.100), web browsing -Allow

Untrust (any) to Untrust (1.1.1.100), web browsing - Allow

Untrust (any) to Untrust (10.1.1.100), web browsing -Allow

Untrust (any) to DMZ (1.1.1.100), web browsing - Allow

What is the purpose of the automated commit recovery feature?

It reverts the firewall configuration if the firewall recognizes a loss of connectivity to Panorama after the change.

It reverts the Panorama configuration.

It causes HA synchronization to occur automatically between the HA peers after a push from Panorama.

It reverts the firewall configuration if the firewall recognizes a loss of connectivity to Panorama after the change.

It generates a config log after the Panorama configuration successfully reverts to the last running configuration.

Given the screenshot, what are two correct statements about the logged traffic? (Choose two.)

The traffic was denied by URL filtering.

The web session was unsuccessfully decrypted.

The traffic was denied by security profile.

The traffic was denied by URL filtering.

Refer to the exhibit. An administrator is using DNAT to map two servers to a single public IP address.Traffic will be steered to the specific server based on the application, where Host A (10.1.1.100) receives HTTP traffic and Host B (10.1.1.101) receives SSH traffic. Which two Security policy rules will accomplish this configuration? (Choose two.)

Untrust (Any) to DMZ (1.1.1.100), ssh - Allow

Untrust (Any) to DMZ (1.1.1.100), web-browsing - Allow

Untrust (Any) to DMZ (1.1.1.100), ssh - Allow

Untrust (Any) to Untrust (10.1.1.1), web-browsing -Allow

Untrust (Any) to Untrust (10.1.1.1), ssh -Allow

Untrust (Any)to DMZ (10.1.1.100. 10.1.1.101), ssh, web-browsing-Allow

Untrust (Any) to DMZ (1.1.1.100), web-browsing - Allow

Starting with PAN-OS version 9.1, application dependency information is now reported in which two locations? (Choose two.)

on the App Dependency tab in the Commit Status window

on the Application tab in the Security Policy Rule creation window

on the App Dependency tab in the Commit Status window

on the Policy Optimizer's Rule Usage page

on the Application tab in the Security Policy Rule creation window

on the Objects > Applications browser pages

What action will inform end users when their access to Internet content is being restricted?

Enable 'Response Pages' on the interface providing Internet access.

Create a custom 'URL Category' object with notifications enabled.

Publish monitoring data for Security policy deny logs.

Ensure that the 'site access" setting for all URL sites is set to 'alert'.

Enable 'Response Pages' on the interface providing Internet access.

What is a recommended consideration when deploying content updates to the firewall from Panorama?

After deploying content updates, perform a commit and push to Panorama.

Before deploying content updates, always check content release version compatibility.

Content updates for firewall A/P HA pairs can only be pushed to the active firewall.

Content updates for firewall A/A HA pairs need a defined master device.

After deploying content updates, perform a commit and push to Panorama.

Which information is included in device state other than the local configuration?

device group and template settings pushed from Panorama

audit logs to provide information of administrative account changes

system logs to provide information of PAN-OS changes

device group and template settings pushed from Panorama

Based on the graphic, what is the purpose of the SSL/TLS Service profile configuration option?

It defines the certificate to send to the client's browser from the management interface.

It defines the SSUTLS encryption strength used to protect the management interface.

It defines the CA certificate used to verify the client's browser.

It defines the certificate to send to the client's browser from the management interface.

It defines the firewall's global SSL/TLS timeout values.

An administrator is troubleshooting an issue with traffic that matches the intrazone-default rule, which is set to default configuration.What should the administrator do?

change the logging action on the rule

tune your Traffic Log filter to include the dates

When is the content inspection performed in the packet flow process?

after the application has been identified

after the SSL Proxy re-encrypts the packet

before the packet forwarding process

Choose the option that correctly completes this statement. A Security Profile can block or allow traffic ____________.

after it is matched by a security policy rule that allows traffic.

on either the data place or the management plane.

after it is matched by a security policy rule that allows traffic.

before it is matched to a Security policy rule.

after it is matched by a security policy rule that allows or blocks traffic.

Which action would an administrator take to ensure that a service object will be available only to the selected device group?

ensure that disable override is cleared

create the service object in the specific template

ensure that disable override is selected

ensure that disable override is cleared

If using group mapping with Active Directory Universal Groups, what must you do when configuring the User-ID?

Configure a frequency schedule to clear group mapping cache

Create an LDAP Server profile to connect to the root domain of the Global Catalog server on port 3268 or 3269 for SSL

Configure a frequency schedule to clear group mapping cache

Configure a Primary Employee ID number for user-based Security policies

Create a RADIUS Server profile to connect to the domain controllers using LDAPS on port 636 or 389

Which feature would be useful for preventing traffic from hosting providers that place few restrictions on content, whose services are frequently used by attackers to distribute illegal or unethical material?

Palo Alto Networks Bulletproof IP Addresses

Palo Alto Networks C&C IP Addresses

Palo Alto Networks Known Malicious IP Addresses

Palo Alto Networks High-Risk IP Addresses

Palo Alto Networks PCNSA Practice Test 5 - Free Online Exam Prep & Questions

Question 1 / 40

What must be considered with regards to content updates deployed from Panorama?

Content update schedulers need to be configured separately per device group.

Panorama can only install up to five content versions of the same type for potential rollback scenarios.

A PAN-OS upgrade resets all scheduler configurations for content updates.

Panorama can only download one content update at a time for content updates of the same type.

Comment (0)

Palo Alto Networks PCNSA Practice Test 5

Question

Palo Alto Networks PCNSA Practice Tests

Practice Tests