ExamGecko

Palo Alto Networks PCNSA Practice Test - Questions Answers, Page 19

Question list
Search
Search

What two authentication methods on the Palo Alto Networks firewalls support authentication and authorization for role-based access control? (Choose two.)

A.
SAML
A.
SAML
Answers
B.
TACACS+
B.
TACACS+
Answers
C.
LDAP
C.
LDAP
Answers
D.
Kerberos
D.
Kerberos
Answers
Suggested answer: A, B

Explanation:

Reference: https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/firewalladministration/manage-firewall-administrators/administrative-authentication.html

Choose the option that correctly completes this statement. A Security Profile can block or allow traffic ____________.

A.
on either the data place or the management plane.
A.
on either the data place or the management plane.
Answers
B.
after it is matched by a security policy rule that allows traffic.
B.
after it is matched by a security policy rule that allows traffic.
Answers
C.
before it is matched to a Security policy rule.
C.
before it is matched to a Security policy rule.
Answers
D.
after it is matched by a security policy rule that allows or blocks traffic.
D.
after it is matched by a security policy rule that allows or blocks traffic.
Answers
Suggested answer: B

Explanation:

Reference:

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security-policy.html

Given the topology, which zone type should you configure for firewall interface E1/1?

A.
Tap
A.
Tap
Answers
B.
Tunnel
B.
Tunnel
Answers
C.
Virtual Wire
C.
Virtual Wire
Answers
D.
Layer3
D.
Layer3
Answers
Suggested answer: A

Which two features can be used to tag a username so that it is included in a dynamic user group?

(Choose two.)

A.
GlobalProtect agent
A.
GlobalProtect agent
Answers
B.
XML API
B.
XML API
Answers
C.
User-ID Windows-based agent
C.
User-ID Windows-based agent
Answers
D.
log forwarding auto-tagging
D.
log forwarding auto-tagging
Answers
Suggested answer: B, C

For the firewall to use Active Directory to authenticate users, which Server Profile is required in the Authentication Profile?

A.
TACACS+
A.
TACACS+
Answers
B.
RADIUS
B.
RADIUS
Answers
C.
LDAP
C.
LDAP
Answers
D.
SAML
D.
SAML
Answers
Suggested answer: C

Explanation:

Reference:

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/authentication/configure-anauthenticationprofile-and-sequence

Which type of security policy rule will match traffic that flows between the Outside zone and inside zone, but would not match traffic that flows within the zones?

A.
global
A.
global
Answers
B.
intrazone
B.
intrazone
Answers
C.
interzone
C.
interzone
Answers
D.
universal
D.
universal
Answers
Suggested answer: C

Explanation:

Reference:

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/software-and-contentupdates/dynamiccontentupdates.html#:~:text=WildFire%20signature%20updates%20are%20made,within%20a%20minute%20of%20availability

Which license is required to use the Palo Alto Networks built-in IP address EDLs?

A.
DNS Security
A.
DNS Security
Answers
B.
Threat Prevention
B.
Threat Prevention
Answers
C.
WildFire
C.
WildFire
Answers
D.
SD-Wan
D.
SD-Wan
Answers
Suggested answer: B

Explanation:

Reference:

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/use-an-external-dynamic-listin-policy/builtin-edls.html#:~:text=With%20an%

Which component is a building block in a Security policy rule?

A.
decryption profile
A.
decryption profile
Answers
B.
destination interface
B.
destination interface
Answers
C.
timeout (min)
C.
timeout (min)
Answers
D.
application
D.
application
Answers
Suggested answer: D

Explanation:

Reference:

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-web-interface-help/policies/policiessecurity/buildingblocks-in-a-security-policy-rule.html

An administrator would like to use App-ID's deny action for an application and would like that action updated with dynamic updates as new content becomes available.

Which security policy action causes this?

A.
Reset server
A.
Reset server
Answers
B.
Reset both
B.
Reset both
Answers
C.
Deny
C.
Deny
Answers
D.
Drop
D.
Drop
Answers
Suggested answer: C

Explanation:

Reference:

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/firewall-administration/manageconfigurationbackups/revert-firewall-configuration- changes.html

Which DNS Query action is recommended for traffic that is allowed by Security policy and matches Palo Alto Networks Content DNS Signatures?

A.
block
A.
block
Answers
B.
sinkhole
B.
sinkhole
Answers
C.
alert
C.
alert
Answers
D.
allow
D.
allow
Answers
Suggested answer: B

Explanation:

To enable DNS sinkholing for domain queries using DNS security, you must activate your DNS Security subscription, create (or modify) an Anti-Spyware policy to reference the DNS Security service, configure the log severity and policy settings for each DNS signature category, and then attach the profile to a security policy rule.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-admin/threat-prevention/dnssecurity/enable-dns-security

Total 362 questions
Go to page: of 37