PCNSA Premium PDF & Test Engine Files with 360 Questions & Answers [Q80-Q99]

4.5/5 - (2 Stimmen)

PCNSA Premium PDF & Test Engine Files with 360 Questions & Answers

Get 100% Real PCNSA Exam Questions, Accurate & Verified Answers As Seen in the Real Exam!

Q80. What is a default setting for NAT Translated Packets when the destination NAT translation is selected as Dynamic IP (with session distribution)?

IP Hash

Source IP Hash

Round Robin

Least Sessions

When the destination NAT translation is selected as Dynamic IP (with session distribution), the firewall uses a round-robin algorithm to distribute sessions among the available IP addresses that are resolved from the FQDN. This option allows you to load-balance traffic to multiple servers that have dynamic IP addresses1. References: Destination NAT, NAT, Getting Started: Network Address Translation (NAT).

Q81. Arrange the correct order that the URL classifications are processed within the system.

Erläuterung
First – Block List
Second – Allow List
Third – Custom URL Categories
Fourth – External Dynamic Lists
Fifth – Downloaded PAN-DB Files
Sixth – PAN-DB Cloud

Q82. Match the Palo Alto Networks Security Operating Platform architecture to its description.

Erläuterung
Threat Intelligence Cloud – Gathers, analyzes, correlates, and disseminates threats to and from the network and endpoints located within the network.
Next-Generation Firewall – Identifies and inspects all traffic to block known threats Advanced Endpoint Protection – Inspects processes and files to prevent known and unknown exploits

Q83. Which two firewall components enable you to configure SYN flood protection thresholds? (Choose two.)

QoS profile

DoS Protection profile

Zone Protection profile

DoS Protection policy

Erläuterung
Referenz:
https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/policy/security-profiles

Q84. Which two features can be used to tag a user name so that it is included in a dynamic user group? (Choose two)

XML API

log forwarding auto-tagging

GlobalProtect agent

User-ID Windows-based agent

https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-admin/url-filtering/url-filtering-concepts/url-filtering-profile-actions

Q85. Identify the correct order to configure the PAN-OS integrated USER-ID agent.
3. add the service account to monitor the server(s)
2. define the address of the servers to be monitored on the firewall
4. commit the configuration, and verify agent connection status
1. create a service account on the Domain Controller with sufficient permissions to execute the User-ID agent

2-3-4-1

1-4-3-2

3-1-2-4

1-3-2-4

First you create the account, then you add the, account in the firewall, then you add the servers you want to monitor and finally you apply the changes.

Q86. The PowerBall Lottery has reached an unusually high value this week. Your company has decided to raise morale by allowing employees to access the PowerBall Lottery website (www.powerball.com) for just this week. However, the company does not want employees to access any other websites also listed in the URL filtering “gambling” category.
Which method allows the employees to access the PowerBall Lottery website but without unblocking access to the “gambling” URL category?

Add just the URL www.powerball.com to a Security policy allow rule.

Manually remove powerball.com from the gambling URL category.

Add *.powerball.com to the URL Filtering allow list.

Create a custom URL category, add *.powerball.com to it and allow it in the Security Profile.

Q87. Which security policy rule would be needed to match traffic that passes between the Outside zone and Inside zone, but does not match traffic that passes within the zones?

intrazone

interzone

universal

global

Q88. Given the Cyber-Attack Lifecycle diagram, identify the stage in which the attacker can initiate malicious code against a targeted machine.

Exploitation

Installation

Reconnaissance

Act on Objective

Q89. Assume that traffic matches a Security policy rule but the attached Security Profiles is configured to block matching traffic.
Which statement accurately describes how the firewall will apply an action to matching traffic?

If it is a block rule, then Security Profile action is applied last.

If it is an allow rule, then the Security policy rule is applied last.

If it is a block rule, then the Security policy rule action is applied last.

If it is an allowed rule, then the Security Profile action is applied last.

Security Profiles are added to the end of Security policy rules. After a packet has been allowed by the Security policy.

Q90. Employees are shown an application block page when they try to access YouTube. Which security policy is blocking the YouTube application?

intrazone-default

Deny Google

allowed-security services

interzone-default

Q91. How do you reset the hit count on a security policy rule?

First disable and then re-enable the rule.

Reboot the data-plane.

Select a Security policy rule, and then select Hit Count > Reset.

Type the CLI command reset hitcount <POLICY-NAME>.

Q92. What are the two default behaviors for the intrazone-default policy? (Choose two.)

Allow

Logging disabled

Log at Session End

Deny

By default, the firewall implicitly allows intrazone traffic (within a zone) and implicitly denies interzone traffic (between zones).
By default, traffic allowed or denied by the implicit Security policy rules is not logged on the firewall.

Q93. An administrator would like to see the traffic that matches the interzone-default rule in the traffic logs.
What is the correct process to enable this logging?

Select the interzone-default rule and click Override; on the Actions tab, select Log at Session End and click OK.

Select the interzone-default rule and edit the rule; on the Actions tab, select Log at Session End and click OK.

Select the interzone-default rule and edit the rule; on the Actions tab, select Log at Session Start and click OK.

This rule has traffic logging enabled by default; no further action is required.

Q94. Drag and Drop Question
Drag the steps into the correct order to create a static route.

Q95. Given the topology, which zone type should zone A and zone B to be configured with?

Layer3

Tap

Layer2

Virtual Wire

Q96. Order the steps needed to create a new security zone with a Palo Alto Networks firewall.

Erläuterung
Step 1 – Select network tab
Step 2 – Select zones from the list of available items
Step 3 – Select Add
Step 4 – Specify Zone Name
Step 5 – Specify Zone Type
Step 6 – Assign interfaces as needed

Q97. Drag and Drop Question
Match each feature to the DoS Protection Policy or the DoS Protection Profile.
Select and Place:

Q98. Which data-plane processor layer of the graphic shown provides uniform matching for spyware and vulnerability exploits on a Palo Alto Networks Firewall?

Signature Matching

Network Processing

Security Processing

Security Matching

Q99. Given the detailed log information above, what was the result of the firewall traffic inspection?

It denied the category DNS phishing.

It denied the traffic because of unauthorized attempts.

It was blocked by the Anti-Virus Security profile action.

It was blocked by the Anti-Spyware Profile action.

Laden …

Target Audience

The PCNSA certification is intended for anyone who is seeking to demonstrate an in-depth knowledge of Palo Alto Networks technologies, including the following IT professionals: system engineers, system administrators, system integrators, support specialists, as well as those clients who leverage Palo Alto Networks products.

PCNSA Premium Files Practice Valid Exam Dumps Question: https://www.real4prep.com/PCNSA-exam.html