Bundle
Package deal FOR PCNSA EXAM WITH COMPLETE SOLUTION 2023
10 Items
PCNSA Flash Cards verified answers 2023
1. The Palo Alto Networks Cybersecurity Portfolio focuses on which three principle technologies? (Choose three.) A. securing operations response B. secur... [Show More] ing the enterprise C. securing third-party application access D. securing the cloud E. securing the internet of things ABD 2. What are four components of the Palo Alto Networks Cybersecurity Portfolio? (Choose four.) A. Cortex DynamicDNS B. Wildfire C. Cortex XDR D. OpenConnect E. Prisma Access F. Autofocus BCEF 3. Which cloud-delivered security service provides instant access to community-based threat data? A. Prisma Saas B. Autofocus C. Unit 42 D. Cortex XOR B 4. Which cloud-delivered security service provides security and connectivity for branches and mobile users? A. Cortex XSOAR B. Cortex XOR C. AutoFocus D. Prisma Access D 5. Which Palo Alto Networks Cybersecurity Portfolio product provides access to applications from Palo Alto Networks, third parties, and customers? A. WildFire B. Cortex Data Lake C. Network Security D. Prisma Access B 6. Which Palo Alto Networks firewall feature provides all the following abilities? • Stops malware, exploits, and ransomware before they can compromise endpoints • Provides protection while endpoints are online and offline, on network and off • Coordinates enforcement with network and cloud security to prevent successful attacks • Detects threats and automates containment to minimize impact • Creates zero-day malware signatures with cloud-based threat analysis • Integrates with Palo Alto Networks Cortex Data Lake A. Cortex XDR B. Prisma Saas C. WildFire D. AutoFocus A 7. Which three management features does the Control Plane provide? (Choose three .) A. security processing B. logging C. reporting D. firewall configuration E. signature matching F. network processing BCD 8. Which three data processing features does the data plane provide? (Choose three .) A. security processing B. logging C. reporting D. firewall configuration E. signature matching F. network processing AEF 9. What are three components of the Network Processing module? (Choose three.) A. QoS B. NAT C. App-ID D. flow control E. URL match F. spyware ABD 10. Which approach most accurately defines the Palo Alto Networks SP3 architecture? A. prioritize first B. sequential processing C. scan it all, scan it once D. Zero Trust segmentation platform C 11. What is the result of using a stream-based architectural design? A. superior performance B. increased latency C. detailed logging D. increased functionality A 12. Which security model does Palo Alto Networks recommend that you deploy? A. separation-of-trust B. Zero Trust C. trust-then-verify D. never trust B 13. The Zero Trust model is implemented to specifically inspect which type of traffic? A. east-west B. north-south C. left-right D. up-down A 14. What are the three main concepts of Zero Trust? (Choose three.) A. All resources are accessed in a secure manner, regardless of location. B. Access control is on a "need-to-know" basis and is strictly enforced. C. Credentials need to be verified. D. All traffic is logged and inspected. E. Internal users are trusted implicitly . F. External users are trusted explicit ly. ABD 15. Which two statements are true about the Zero Trust model? (Choose two.) A. Traffic is inspected laterally. B. Traffic is inspected east-west. C. Internal traffic is implicitly trusted. D. External traffic is implicitly trusted. AB 16. Which three Palo Alto Networks products secure your network? (Choose three.) A. MineMerge B. Prisma Saas C. URL filtering D. Containers E. TrapContent F. Wildfire BCF Page 33 17. True or false: Blockage of just one stage in the cyberattack lifecycle will protect a company's network from attack. A. true B. false A 18. What are two stages of the cyberattack lifecycle? (Choose two.) A. weaponization and delivery B. manipulation C. extraction D. command and control AD 19. Command and control can be prevented through which two methods? (Choose two.) A. exploitation B. DNS Sinkholing C. URL filtering D. reconnaissance BC 20. Exploitation can be mitigated by which two actions? (Choose two.) A. keeping systems patched B. using local accounts C. blocking known and unknown vulnerability exploits on the endpoint D. providing admin credentials AC 21. What are two firewall management methods? (Choose two.) A. CLI B. RDP C. VPN D. XML API AD [Show Less]
- Exam
- $20.45
- 0
- 159
PCNSA questions and answers latest 2023
Palo Alto NGFWs enable you to adopt security best practices to minimize opportunities for attack by using the following three policy types... Application,... [Show More] User, and Content based policies. T/F: Palo Alto NGFWs allow you to automate workflows via integration with administrative tools such as ticketing services, or any system with a RESTful API. True What are the three families of Palo Alto NGFWs? 1) VM Series 2) Prisma Access (Cloud Firewall SaaS) 3) Physical Firewalls Name at least three of the physical Palo Alto NGFW models. 1) PA-220 2) PA800 3) PA-3200 4) PA-5200 5) PA-7000 Older models include: PA-200, PA-500, PA-3000 and PA-5000. What capabilities does Palo Alto Traps Advanced Endpoint Protection provide? Advanced Endpoint Protection blocks: exploits, ransomware, malware, and fileless attacks to minimize infected endpoints and servers. What does AutoFocus provide? AutoFocus provides instant access to community-based threat data, enhanced with deep context and attribution from the Unit 42 threat research team, saving analysts time and effort. How often is the WildFire cloud database updated? Approximately every 5 minutes. What is Palo Alto WildFire? WildFire is a cloud based malware analysis and zero day exploit detection feature. What is Palo Alto Threat Prevention? Threat Prevention is an IPS feature for detecting network signatures. What is Palo Alto URL Filtering? URL Filtering is a feature for categorizing web traffic and preventing phishing attempts. What is Palo Alto MineMeld? MineMeld is a threat intelligence aggregation tool for gathering and applying IOCs at the firewall. What is Palo Alto Cortex Data Lake? Cortex Data Lake is a tool for collecting and managing vast amounts of security logs. What is Palo Alto Cortex XDR? Cortex XDR is a machine learning UBA tool, for detecting post-intrusion activities, such as risky behavior, data exfiltration, or anomalies. The Palo Alto Networks Security Operating Platform is designed for which three purposes? A) consume innovations quickly B) ensure compliance C) focus on what matters D) prevent successful cyberattacks A) consume innovations quickly C) focus on what matters D) prevent successful cyberattacks Which item is not one of the six primary components of the Palo Alto Networks Security Operating Platform? A) applications (Palo Alto Networks applications, third-party applications, customer applications) B) Cloud-Delivered Security Services C) WildFire D) Cortex and Cortex Data Lake E) Network Security F) Advanced Endpoint Protection G) Cloud Security C) WildFire Which cloud-delivered security service provides instant access to community-based threat data? A) Prisma SaaS B) AutoFocus C) Threat 42 D) Cortex XDR B) AutoFocus Which cloud-delivered security service provides security for branches and mobile users? A) MineMeld B) Cortex XDR C) AutoFocus D) Prisma Access D) Prisma Access Which Palo Alto Networks Security Operating Platform component provides access to applications from Palo Alto Networks, third parties, and customers? A) Cloud-Delivered Security Services B) WildFire C) Cortex D) Network Security E) Advanced Endpoint Protection C) Cortex Which Palo Alto Networks firewall feature provides all the following abilities? • Stops malware, exploits, and ransomware before they can compromise endpoints • Provides protection while endpoints are online and offline, on network and off • Coordinates enforcement with network and cloud security to prevent successful attacks • Detects threats and automates containment to minimize impact • Includes WildFire cloud-based threat analysis service with your Cortex XDR subscription • Integrates with the Palo Alto Networks Security Operating Platform A) Cortex XDR B) Prisma SaaS C) URL Filtering D) WildFire E) GlobalProtect F) AutoFocus A) Cortex XDR What architecture does Palo Alto use to reduce latency with processing packets? Single-Pass Parallel Processing (SP3) architecture. What are the two components of Single-Pass Parallel Processing (SP3) architecture? 1) Single-Pass Software 2) Parallel Processing Hardware T/F: Management and Data planes have dedicated hardware resources (CPU, RAM, and storage), making them independent of each other. True [Show Less]
- Exam
- $29.95
- 0
- 170
PCNSA Exam questions with correct answer 100%
Recently changes were made to the firewall to optimize the policies and the security team wants to see if those changes are helping. What is the quickest w... [Show More] ay to reset the hit counter to zero in all the security policy rules?
A. At the CLI enter the command reset rules and press Enter
B. Highlight a rule and use the Reset Rule Hit Counter > Selected Rules for each rule
C. Reboot the firewall
D. Use the Reset Rule Hit Counter>All Rules option
D. Use the Reset Rule Hit Counter > All Rules option
Which Two App-ID applications will you need to allow in your Security policy to use facebook-chat?
A. facebook
B. facebook-chat
C. facebook-base
D. facebook-email
B. facebook-chat
C. facebook-base
Which User-ID agent would be appropriate in a network with multiple WAN links, limited network bandwidth, and limited firewall management plane resources?
A. Windows-based agents deployed on the internal network
B. PAN-OS integrated agent deployed on the internal network
C. Citrix terminal server deployed on the internal network
D. Windows-based agent deployed on each of the WAN Links
A. Windows-based agent deployed on the internal network
Your company requires positive username attribution of every IP address used by the wireless devices to support a new compliance requirement. You must collect IP to user mapping as soon as possible with the minimal configuration changes to the wireless devices themselves. the wireless devices are from various manufactures. Given the scenario, choose the option for sending IP-to user mapping to the NGFW.
A. syslog
B. RADIUS
C. UID redistribution
D. XFF headers
A. syslog
An administrator receives a global notification for a new malware that infects hosts. The infection will result in the infected host attempting to contact a command- and-control (C2) server. Which two security profile components will detect and prevent this threat after the firewall's signature database has been updated? (Choose two.)
A. vulnerability protection profile applied to outbound security policies
B. anti-spyware profile applied to outbound security policies
C. antivirus profile applied to outbound security policies
D. URL filtering profile applied to outbound security policies
B. anti-spyware profile applied to outbound security polices
D. URL filtering profile applied to out bound security
Which interface does not require a MAC or IP address?
A. Virtual Wire
B. Layer3
C. Layer2
D. Loopback
A. Virtual Wire
Order the steps needed to create a new security zone with a Palo Alto Networks firewall.
Step 1 : Select Network
Step 2: Select Zones from the list of available items
Step 3: Select add
Step 4: Specify Zone Name
Step 5: Specify Zone type
Step 6: Assign interface as needed
What are two differences between an implicit dependency and an explicit dependency in App-ID? (Choose two.)
A. An implicit dependency does not require the dependent application to be added in the security policy
B. An implicit dependency requires the dependent application to be added in the security policy
C. An explicit dependency does not require the dependent application to be added in the security policy
D. An explicit dependency requires the dependent application to be added in the security policy
A. An implicit dependency does not require the dependent application to be added in the security policy
D. An explicit dependency requires the dependent application to be added in the security policy
Which plane on a Palo Alto Networks Firewall provides configuration, logging, and reporting functions on a separate processor?
A. management
B. network processing
C. data
D. security processing
A. management
A security administrator has configured App-ID updates to be automatically downloaded and installed. The company is currently using an application identified byApp-ID as SuperApp_base.On a content update notice, Palo Alto Networks is adding new app signatures labeled SuperApp_chat and SuperApp_download, which will be deployed in 30 days.Based on the information, how is the SuperApp traffic affected after the 30 days have passed?
A. All traffic matching the SuperApp_chat, and SuperApp_download is denied because it no longer matches the SuperApp-base application
B. No impact because the apps were automatically downloaded and installed
C. No impact because the firewall automatically adds the rules to the App-ID interface
D. All traffic matching the SuperApp_base, SuperApp_chat, and SuperApp_download is denied until the security administrator approves the applications
C. No impact because the firewall automatically adds the rules to the App-ID interface
How many zones can an interface be assigned with a Palo Alto Networks firewall?
A. two
B. three
C. four
D. one
D. one
Which option shows the attributes that are selectable when setting up application filters?
A. Category, Subcategory, Technology, and Characteristic
B. Category, Subcategory, Technology, Risk, and Characteristic
C. Name, Category, Technology, Risk, and Characteristic
D. Category, Subcategory, Risk, Standard Ports, and Technology
B. Category, Subcategory, Technology, Risk, and Characteristic
Actions can be set for which two items in a URL filtering security profile? (Choose two.)
A. Block List
B. Custom URL Categories
C. PAN-DB URL Categories
D. Allow List
A. Block List
D. Allow List
Which two statements are correct about App-ID content updates? (Choose two.)
A. Updated application content might change how Security policy rules are enforced.
B. After an application content update, new applications must be manually classified prior to use.
C. Existing security policy rules are not affected by application content updates.
D. After an application content update, new applications are automatically identified and classified.
C. Existing security policy rules are not affected by application content updates.
D. After an application content update, new applications are automatically identified and classified.
Which User-ID mapping method should be used for an environment with users that do not authenticate to Active Directory?
A. Windows session monitoring
B. passive server monitoring using the Windows-based agent
C. Captive Portal
D. passive server monitoring using a PAN-OS integrated User-ID agent
C. Captive Portal
An administrator needs to allow users to use their own office applications. How should the administrator configure the firewall to allow multiple applications in a dynamic environment?
A. Create an Application Filter and name it Office Programs, then filter it on the business-systems category, office-programs subcategory
B. Create an Application Group and add business-systems to it
C. Create an Application Filter and name it Office Programs, then filter it on the business-systems category
D. Create an Application Group and add Office 365, Evernote, Google Docs, and Libre Office
B. Create an Application Group and add business-systems to it
Which statement is true regarding a Best Practice Assessment?
A. The BPA tool can be run only on firewalls
B. It provides a percentage of adoption for each assessment area
C. The assessment, guided by an experienced sales engineer, helps determine the areas of greatest risk where you should focus prevention activities
D. It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture
B. It provides a percentage of adoption for each assessment area
Choose the option that correctly completes this statement. A Security Profile can block or allow traffic ____________.
A. on either the data place or the management plane.
B. after it is matched by a security policy rule that allows traffic.
C. before it is matched to a Security policy rule.
D. after it is matched by a security policy rule that allows or blocks traffic.
D. after it is matched by a security policy rule that allows or blocks traffic.
A company moved its old port-based firewall to a new Palo Alto Networks NGFW 60 days ago. Which utility should the company use to identify out-of-date or unused rules on the firewall?
A. Rule Usage Filter > No App Specified
B. Rule Usage Filter >Hit Count > Unused in 30 days
C. Rule Usage Filter > Unused Apps
D. Rule Usage Filter > Hit Count > Unused in 90 days
D. Rule Usage Filter > Hit Count > Unused in 90 days
Which Security Profile mitigates attacks based on packet count?
A. zone protection profile
B. URL filtering profile
C. antivirus profile
D. vulnerability profile
A. zone protection profile
Which interface type uses virtual routers and routing protocols?
A. Tap
B. Layer3
C. Virtual Wire
D. Layer2
B. Layer3
Which URL Filtering Profile action does not generate a log entry when a user attempts to access a URL?
A. Override
B. Allow
C. Block
D. Continue
B. Allow
An internal host needs to connect through the firewall using source NAT to servers of the internet. Which policy is required to enable source NAT on the firewall?
A. NAT policy with internal zone and internet zone specified
B. post-NAT policy with external source and any destination address
C. NAT policy with no internal or internet zone selected
D. pre-NAT policy with external source and any destination address
A. NAT policy with internal zone and internet zone specified
Which Security Profile can provide protection against ICMP floods, based on individual combinations of a packets source and destination IP addresses?
A. DoS protection
B. URL filtering
C. packet buffering
D. anti-spyware
A. DoS protection
Which path in PAN-OS 9.0 displays the list of port-based security policy rules?
A. Policies> Security> Rule Usage> No App Specified
B. Policies> Security> Rule Usage> Port only specified
C. Policies> Security> Rule Usage> Port-based Rules
D. Policies> Security> Rule Usage> Unused Apps
Answer : C
Which two components are utilized within the Single-Pass Parallel Processing architecture on a Palo Alto Networks Firewall? (Choose two.)
A. Layer-ID
B. User-ID
C. QoS-ID
D. App-ID
B. User-ID
D. App-ID
Which path is used to save and load a configuration with a Palo Alto Networks firewall?
A. Device>Setup>Services
B. Device>Setup>Management
C. Device>Setup>Operations
D. Device>Setup>Interfaces
C. Device>Setup>Operations
Which action related to App-ID updates will enable a security administrator to view the existing security policy rule that matches new application signatures?
A. Review Policies
B. Review Apps
C. Pre-analyze
D. Review App Matches
A. Review Policies
How do you reset the hit count on a Security policy rule?
A. Select a Security policy rule, and then select Hit Count > Reset.
B. Reboot the data-plane.
C. First disable and then re-enable the rule.
D. Type the CLI command reset hitcount
- Exam
- $14.45
- 0
- 151
PCNSA question and answer latest 2023
Which two actions are available for antivirus security profiles? (Choose two.) A. continue B. allow C. block IP D. alert B. allow D. alert Whi... [Show More] ch two HTTP Header Logging options are within a URL filtering profile? (Choose two.) A. User‐Agent B. Safe Search C. URL redirection D. X‐Forward‐For A. User‐Agent D. X‐Forward‐For What are the two components of Denial‐of‐Service Protection? (Choose two.) A. zone protection profile B. DoS protection profile and policy rules C. flood protection D. reconnaissance protection A. zone protection profile B. DoS protection profile and policy rules Which two types of attacks does the PAN‐DB prevent? (Choose two.) A. phishing sites B. HTTP based command‐and‐control C. infected JavaScript D. flood attacks A. phishing sites B. HTTP based command‐and‐control Which two valid URLs can be used in a custom URL category? (Choose two.) A. ww.youtube.** B. www.**.com C. www.youtube.com D. *.youtube.com C. www.youtube.com D. *.youtube.com What are three methods of mapping usernames to IP addresses? (Choose three.) A. Server Monitoring B. Traps C. Minemeld D. syslog E. AutoFocus F. port mapping A. Server Monitoring D. syslog F. port mapping Which type of server profile is used to create group mappings? A. RADIUS B. TACACS+ C. Kerberos D. LDAP D. LDAP The Server Monitoring user mapping method can monitor which three types of servers? (Choose three.) A. RADIUS B. Microsoft Domain Controllers C. Exchange Servers D. Novell eDirectory Servers B. Microsoft Domain Controllers C. Exchange Servers D. Novell eDirectory Servers The Port Mapping user mapping method can monitor which two types of environments? (Choose two.) A. Citrix B. Microsoft terminal servers C. Exchange Servers D. Linux servers A. Citrix B. Microsoft terminal servers The Windows User‐ID Agent can be installed on which two operating systems? (Choose two.) A. Linux B. Server 2016 C. XP D. Server 2008 B. Server 2016 D. Server 2008 A Heatmap provides an adoption rate for which three features? (Choose three.) A. WildFire B. Traps C. File Blocking D. User‐ID E. SSL certificates F. authentication profiles A. WildFire C. File Blocking D. User‐ID What are three Best Practice Assessment tool primary categories? (Choose three.) A. User‐ID B. Logging C. Vulnerability Protection D. Security E. Decryption F. DoS Protection D. Security E. Decryption F. DoS Protection Which two security features normally do not achieve an adoption rate of 100%? (Choose two.) A. URL Filtering B. App‐ID C. Logging D. DNS Sinkhole D. DNS Sinkhole A. URL Filtering Which type of file is used to generate the Heatmap report and the BPA report? A. Technical Support B. Configuration C. Statistics D. XML A. Technical Support What are two components of the BPA tool? (Choose two.) A. Security Policy Adoption Heatmap B. BPA C. XML D. Security Policy A. Security Policy Adoption Heatmap B. BPA The Palo Alto Networks Security Operating Platform is designed for which three purposes? (Choose three.) A. consume innovations quickly B. ensure compliance C. focus on what matters D. prevent successful cyberattacks A. consume innovations quickly C. focus on what matters D. prevent successful cyberattacks Which item is not one of the six primary components of the Palo Alto Networks Security Operating Platform? A. Applications (Palo Alto Networks apps, third‐party apps, customer apps) B. Cloud‐Delivered Security Services C. WildFire D. Application Framework and Logging Service E. Network Security F. Advanced Endpoint Protection G. Cloud Security C. WildFire Which cloud‐delivered security service provides instant access to community‐based threat data? A. Aperture B. AutoFocus C. Threat 42 D. Magnifier B. AutoFocus - It provides instant access to community‐based threat data, enhanced with deep context and attribution from the Unit 42 threat research team A. Aperture C. Threat 42 - Unit 42 threat research team D. Magnifier - Magnifier behavioral analytics applies machine learning at a cloud scale to network, endpoint, and cloud data so that you can quickly find and stop targeted attacks, insider abuse, and compromised endpoints Which cloud‐delivered security services provides security for branches and mobile users? A. MineMeld B. Magnifier C. Traps D. Global Protect D. Global Protect Which Palo Alto Networks Security Operating Platform component provides access to apps from Palo Alto Networks, third parties, and customers? A. Applications (Palo Alto Networks apps, third‐party apps, customer apps) B. Cloud‐Delivered Security Services C. WildFire D. Application Framework E. Network Security F. Advanced Endpoint Protection G. Cloud Security D. Application Framework Which Palo Alto Networks firewall feature provides all of the following abilities? Stops malware, exploits, and ransomware before they can compromise endpoints Provides protection while endpoints are online and offline, on network and off Coordinates enforcement with network and cloud security to prevent successful attacks Detects threats and automates containment to minimize impact Includes WildFire cloud‐based threat analysis service with your Traps subscription Integrates with the Palo Alto Networks Security Operating Platform A. Traps B. Aperture C. URL Filtering D. WildFire E. GlobalProtect F. AutoFocus A. Traps Which management features does the control plane provide? (Choose three.) A. security processing B. logging C. reporting D. firewall configuration E. signature matching F. network processing B. logging C. reporting D. firewall configuration Which three data processing features does the data plane provide? (Choose three.) A. network processing B. security processing C. signature matching D. firewall configuration E. logging F. reporting A. network processing B. security processing C. signature matching What are three components of the Network Processing module? (Choose three.) A. QoS B. NAT C. App‐ID D. flow control E. url match F. spyware A. QoS B. NAT D. flow control Which approach most accurately defines the Palo Alto Networks SP3 architecture? A. prioritize first B. sequential processing C. scan it all, scan it once D. zero trust segmentation platform C. scan it all, scan it once What is the result of using a stream‐based design of architecture? A. superior performance B. increased latency C. superior latency D. increased functionality A. superior performance Palo Alto Networks has reduced latency enormously, using the Single‐Pass Parallel Processing (SP3) architecture, which combines two complementary components: Single‐Pass Software Parallel Processing Hardware Which security model does Palo Alto Networks recommend that you deploy? A. separation‐of‐trust B. Zero Trust C. trust‐then‐verify D. never trust B. Zero Trust The Zero Trust model is implemented to specifically address which type of traffic? A. east‐west B. north‐south C. left‐right D. up‐down A. east‐west What are the three main concepts of Zero Trust? (Choose three.) A. All resources are accessed in a secure manner, regardless of location. B. Access control is on a "need‐to‐know" basis and is strictly enforced. C. Credentials need to be verified. D. All traffic is logged and inspected. E. Internal users are trusted implicitly. F. External users are trusted explicitly. A. All resources are accessed in a secure manner, regardless of location. B. Access control is on a "need‐to‐know" basis and is strictly enforced. D. All traffic is logged and inspected. Which two statements are true about the Zero Trust model? (Choose two.) A. Traffic is inspected laterally. B. Traffic is inspected east‐west. C. Internal traffic is implicitly trusted. D. External traffic is implicitly trusted. A. Traffic is inspected laterally. B. Traffic is inspected east‐west. Which three Palo Alto Networks products secure your network? (Choose three.) A. MineMerge B. Aperture C. URL filtering D. AutoMagnifier E. TrapContent F. WildFire B. Aperture C. URL filtering F. WildFire True or false: Blocking just one stage in the Cyber‐Attack Lifecycle is all that is needed to protect a company's network from attack. A. True B. False B. False What are two stages of the Cyber‐Attack Lifecycle? (Choose two.) A. Weaponization and delivery B. Manipulation C. Extraction D. Command and Control A. Weaponization and delivery D. Command and Control Command and control be prevented through which two methods? (Choose two.) A. exploitation B. DNS Sinkholing C. URL filtering D. reconnaissance B. DNS Sinkholing C. URL filtering Exploitation can be mitigated by which two actions? (Choose two.) A. keeping systems patched B. using local accounts C. blocking known and unknown vulnerability exploits on the endpoint D. providing admin credentials A. keeping systems patched C. blocking known and unknown vulnerability exploits on the endpoint What are two firewall management methods? (Choose two.) A. CLI B. RDP C. VPN D. XML API A. CLI D. XML API Which two devices are used to can connect a computer to the firewall for management purposes? (Choose two.) A. rollover cable B. serial cable C. RJ‐45 Ethernet cable D. USB cable B. serial cable C. RJ‐45 Ethernet cable What is the default IP address on the MGT interfaces of a Palo Alto Networks firewall? A. 192.168.1.1 B. 192.168.1.254 C. 10.0.0.1 D. 10.0.0.254 A. 192.168.1.1 What are the two default services that are available on the MGT interface? (Choose two.) A. HTTPS B. SSH C. HTTP D. Telnet A. HTTPS B. SSH True or false. Service route traffic has Security policy rules applied against it. A. True B. False A. True By default, the firewall uses the management interface to communicate with various servers including those for External Dynamic Lists, DNS, email, and Palo Alto Networks updates servers. Service routes are used so that the communication between the firewall and servers goes through the data ports on the data plane. These data ports require appropriate security policies before external servers can be accessed. [Show Less]
- Exam
- $21.45
- 0
- 200
PCNSA questions with complete solution 2023
Threat Intelligence Cloud Identifies and inspects all traffic to block known threats. Next Generation Firewall Gathers, analyzes, correlates, and ... [Show More] disseminates threats to and from network endpoints Advanced Endpoint Detection Inspects processes and files to prevent known and unknown exploits Which firewall plane provides configuration, logging, and reporting functions on a separate processor? A. control B. network processing C. data D. security processing A. Control A security administrator has configured App-ID updates to be automatically downloaded and installed. The company is currently using an application identified by App-ID as SuperApp_base. On a content update notice, Palo Alto Networks is adding new app signatures labeled SuperApp_chat and SuperApp_download, which will be deployed in 30 days. Based on the information, how is the SuperApp traffic affected after the 30 days have passed? A. All traffic matching the SuperApp_chat, and SuperApp_download is denied because it no longer matches the SuperApp-base application B. No impact because the apps were automatically downloaded and installed C. No impact because the firewall automatically adds the rules to the App-ID interface D. All traffic matching the SuperApp_base, SuperApp_chat, and SuperApp_download is denied until the security administrator approves the applications C. No impact because the firewall automatically adds the rules to the App-ID interface How many zones can an interface be assigned with a Palo Alto Networks firewall? A. two B. three C. four D. one D. One Which two configuration settings shown are not the default? (Choose two.) A. Enable Security Log B. Server Log Monitor Frequency (sec) C. Enable Session D. Enable Probing B,C Which data-plane processor layer of the graphic shown provides uniform matching for spyware and vulnerability exploits on a Palo Alto Networks Firewall? A. Signature Matching B. Network Processing C. Security Processing D. Security Matching A Which option shows the attributes that are selectable when setting up application filters? A. Category, Subcategory, Technology, and Characteristic B. Category, Subcategory, Technology, Risk, and Characteristic C. Name, Category, Technology, Risk, and Characteristic D. Category, Subcategory, Risk, Standard Ports, and Technology B Actions can be set for which two items in a URL filtering security profile? (Choose two.) A. Block List B. Custom URL Categories C. PAN-DB URL Categories D. Allow List AD Reconnaissance Stage where the attacker has motivation for attacking a network Installation Stage where the attacker scans for network vulnerabilities Command and Control stage where the attacker will explore methods such as a root kit Act on the objective Stage where the attacker has access to a specific server so they can communicate and pass data to and from devices. Which two statements are correct about App-ID content updates? (Choose two.) A. Updated application content may change how security policy rules are enforced B. After an application content update, new applications must be manually classified prior to use C. Existing security policy rules are not affected by application content updates D. After an application content update, new applications are automatically identified and classified C,D Which User-ID mapping method should be used for an environment with clients that do not authenticate to Windows Active Directory? A. Windows session monitoring via a domain controller B. passive server monitoring using the Windows-based agent C. Captive Portal D. passive server monitoring using a PAN-OS integrated User-ID agent C An administrator needs to allow users to use their own office applications. How should the administrator configure the firewall to allow multiple applications in a dynamic environment? A. Create an Application Filter and name it Office Programs, the filter it on the business-systems category, office-programs subcategory B. Create an Application Group and add business-systems to it C. Create an Application Filter and name it Office Programs, then filter it on the business-systems category D. Create an Application Group and add Office 365, Evernote, Google Docs, and Libre Office B Which statement is true regarding a Best Practice Assessment? A. The BPA tool can be run only on firewalls B. It provides a percentage of adoption for each assessment data C. The assessment, guided by an experienced sales engineer, helps determine the areas of greatest risk where you should focus prevention activities D. It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture B Employees are shown an application block page when they try to access YouTube. Which security policy is blocking the YouTube application? A. intrazone-default B. Deny Google C. allowed-security services D. interzone-default D [Show Less]
- Exam
- $15.45
- 0
- 154
PCNSA questions fully solved 2023
Prevention Posture Assessment (PPA) The PPA is a set of questionnaires that help uncover security risk prevention gaps across all areas of network and sec... [Show More] urity architecture. The PPA not only helps to identify all security risks, it also provides detailed suggestions on how to prevent the risks and close the gaps. The assessment, guided by an experienced Palo Alto Networks sales engineer, helps determine the areas of greatest risk where you should focus prevention activities. You can run the PPA on firewalls and on Panorama. Best Practice Assessment (BPA) Tool The BPA for next-generation firewalls and Panorama evaluates a device's configuration by measuring the adoption of capabilities, validating whether the policies adhere to best practices, and providing recommendations and instructions for how to remediate failed best practice checks. The Security Policy Adoption Heatmap component filters the information by device groups, serial numbers, zones, areas of architecture, and other categories. The results include trending data, which shows the rate of security improvement as you adopt new capabilities, fix gaps, and progress toward a Zero-Trust network. The BPA component performs more than 200 security checks on a firewall or Panorama configuration and provides a pass/fail score for each check. Each check is a best practice identified by Palo Alto Networks security experts. If a check returns a failing score, the tool provides the justification for the failing score and how to fix the issue. In anti-malware, what does false positive mean? a false positive incorrectly identifies a legitimate file or application as malware In anti-malware, what does false negative mean? a false negative incorrectly identifies malware as a legitimate file or application Software as a Service (SaaS) Customers are provided access to an application running on a cloud infrastructure. The application is accessible from various client devices and interfaces, but the customer has no knowledge of, and does not manage or control, the underlying cloud infrastructure. The customer may have access to limited user-specific application settings, and security of the customer data is still the responsibility of the customer. Platform as a Service (PaaS) Customers can deploy supported applications onto the providers cloud infrastructure, but the customer has no knowledge of, and does not manage or control, the underlying cloud infrastructure. The customer has control over the deployed applications and limited configuration settings for the application-hosting environment. The company owns the deployed applications and data, it is therefore responsible for the security of those applications and data. Infrastructure as a Service (IaaS) Customers can provision processing, storage, networks, and other computing resources and deploy and run operating systems and applications. However, the customer has no knowledge of, and does not manage or control, the underlying cloud infrastructure. The customer has control over operating systems, storage, and deployed applications, along with some networking components (for example, host firewalls). The company owns deployed applications and data, and it is therefore responsible for the security of those applications and data. Palo Alto Networks Security Operating Platform is a purpose built, fully integrated cybersecurity approach that helps organizations get control of their networks and protect critical assets Which three options are key components of Security Operating Platform? 1- Network Security 2- Advanced Endpoint Protection 3- Cloud Security What are the essential functional requirements for an effective NGFW include? 1- Application Identification - Accurately identify applications regardless of port, protocol, evasive techniques or encryption. Provide visibility of applications and granular policy-based control over applications, including individual application functions. 2- User identification - Accurately identify users and subsequently use identity information as an attribute for policy control. 3- Content identification - Content identification controls traffic based on complete analysis of all allowed traffic, using multiple threat prevention and data loss prevention techniques in a single pass architecture that fully integrates all security functions. Applications and Threats content Applications and Threats content updates deliver the very latest application and threat signatures to the firewall. The applications portion of the package includes new and modified App-IDs and does not require a license. The full Applications and Threats content package, which also includes new and modified threat signatures, requires a Threat Prevention license. As the firewall automatically retrieves and installs the latest application and threat signatures (based on your custom settings), it starts enforcing security policy based on the latest App-IDs and threat protection without any additional configuration. Security First Posture An organization with a security-first posture prioritizes protection using the latest threat signatures over application availability. You're primarily using the firewall for its threat prevention capabilities. Any changes to App-ID that impact how security policy enforces application traffic is secondary. Mission-critical security posture A mission-critical network prioritizes application availability over protection using the latest threat signatures. Your network has zero tolerance for downtime. The firewall is deployed inline to enforce security policy and if you're using App-ID in security policy, any change a content releases introduces that affects App-ID could cause downtime. PANs use positive enforcement mode. What does that mean? An important point to highlight is that Palo Alto Networks NGFWs use a positive enforcement model, which means that all traffic can be denied except those applications that are expressly allowed via policy. This positive enforcement model means that in some cases the unknown traffic can be easily blocked or tightly controlled. Authentication events. Monitoring of the authentication events on a network allows User-ID to associate a user with the IP address of the device from which the user logs in to enforce policy on the firewall. User-ID can be configured to monitor authentication events for: 1-Microsoft Active Directory: User-ID constantly monitors domain controller event logs to identify users when they log onto the domain. When a user logs onto the Windows domain, a new authentication event is recorded on the corresponding Windows Domain controller. By remotely monitoring the authentication events on Windows domain controllers, User-ID can recognize authentication events to identify users on the network for creation and enforcement of policy. 2-Microsoft Exchange Server: User-ID can be configured to constantly monitor Microsoft Exchange logon events produced by clients accessing their email. Using this technique, even Mac OS X, Apple iOS, and Linux/UNIX client systems that don't directly authenticate to Microsoft Active Directory can be discovered and identified. 3-Novell eDirectory: User-ID can query and monitor logon information to identify users and group memberships via standard lightweight directory access protocol (LDAP) queries on Novell eDirectory servers. User authentication. This technique allows organizations to configure a challengeresponse authentication sequence to collect user and IP address information, using the following tools: 1-Captive Portal: In cases where administrators need to establish rules under which users are required to authenticate to the firewall prior to accessing the internet, Captive Portal can be deployed. Captive Portal is used in cases where the user cannot be identified using other mechanisms. In addition to an explicit username and password prompt, Captive Portal can also be configured to send an NT LAN Manager (NTLM) authentication request to the web browser to make the authentication process transparent to the user. 2-GlobalProtect: Users logging in to the network with GlobalProtect (discussed in Section 3.3.2) provide user and host information to the firewall that, in turn, can be used for policy control. Syslog listener The agent runs a syslog listener on a designated port that can parse the syslog messages and convert the information into appropriate User-ID mappings. Traffic logs These logs display an entry for the start and end of each session. Each entry includes the following information: date and time; source and destination zones, addresses, and ports; application name; security rule applied to the traffic flow; rule action (allow, deny, or drop); ingress and egress interface; number of bytes; and session end reason. Threat logs These logs display entries when traffic matches one of the security profiles attached to a security rule on the firewall. Each entry includes the following information: date and time; type of threat (such as virus or spyware); threat description or URL (Name column); source and destination zones, addresses, and ports; application name; alarm action (such as allow or block); and severity level. URL Filtering logs These logs display entries for traffic that matches URL Filtering Profiles attached to security rules. For example, the firewall generates a log if a rule blocks access to specific websites and website categories or if you configured a rule to generate an alert when a user accesses a website. WildFire Submissions logs The firewall forwards samples (files and em [Show Less]
- Exam
- $17.45
- 0
- 143
PCNSA questions and answer 2023
The Palo Alto Networks Cybersecurity Portfolio focuses on which three principle technologies? Securing the operations response Securing the enterprise S... [Show More] ecuring the cloud What are four components of the Palo Alto Networks Cybersecurity Portfolio? WildFire Cortex XDR Prisma Access AutoFocus Which cloud-delivered security service provides instant access to community-based threat data? AutoFocus Which cloud-delivered security service provides security and connectivity for branches and mobile users? Prisma Access Which Palo Alto Networks cybersecurity portfolio product provides access to applications from Palo Alto Networks, third parties, and customers? Cortex Data Lake Which Palo Alto Networks firewall feature provides all the following abilities? Stops malware, exploits, and ransomware before they can compromise endpoints Provides protection while endpoints are online and offline, on network and off Coordinates enforcement with network and cloud security to prevent successful attacks Detects threats and automates containment to minimize impact Creates zero-day malware signatures with cloud-based threat analysis Integrates with Palo Alto Networks Cortex Data Lake Cortex XDR Which three management features does the Control Plane provide? Logging Reporting Firewall configuration Which three data processing features does the data plane provide? Security processing Signature matching network processing What are three components of the Network Processing module? QoS NAT Flow Control Which approach most accurately defines the Palo Alto Networks SP3 architecture Scan it all, scan it once What is the result of using a stream-based architectural design Superior performance Which security model does Palo Alto Networks recommend that you deploy Zero trust The Zero Trust model is implemented to specifically inspect which type of traffic? East-west [Show Less]
- Exam
- $18.45
- 0
- 204
PCNSA Full SG with full solution 2023
Which four models are the Palo Alto Networks next-generation firewall models? (Choose four.) a. PA-200 Series b. PA-2000 Series c. PA-300 Series d. P... [Show More] A-3200 Series e. PA-400 Series f. PA-5000 Series g. PA-7000 Series a. PA-200 Series d. PA-3200 Series f. PA-5000 Series g. PA-7000 Series Which two planes are found in Palo Alto Networks single-pass platform architecture? (Choose two.) a. control b. single pass c. data d. parallel processing a. control c. data (T/F) The strength of the Palo Alto Networks firewall is its Single-Pass Parallel Processing (SP3) engine. a. true b. false a. true Which new firewall model was introduced with PAN-OS 8.1 with double the data-plane memory? a. PA-5260 b. PA-5270 c. PA-5280 d. PA-5290 c. PA-5280 Palo Alto Networks firewalls are built with a dedicated out-of-band management port that has which three attributes? (Choose three.) a. Labeled MGT by default. b. Passes only management traffic for the device and cannot be configured as a standard traffic port. c. Administrators use the out-of-band management port for direct connectivity to the management plane of the firewall. d. Cannot be configured to use DHCP. a. Labeled MGT by default. b. Passes only management traffic for the device and cannot be configured as a standard traffic port. c. Administrators use the out-of-band management port for direct connectivity to the management plane of Which three statements are true regarding the candidate configuration? (Choose three.) a. You can roll back the candidate configuration by pressing the Undo button. b. You can revert the candidate configuration to the running configuration. c. Clicking Save creates a copy of the current candidate configuration. d. Choosing Commit updates the running configuration with the contents of the candidate configuration. b. You can revert the candidate configuration to the running configuration. c. Clicking Save creates a copy of the current candidate configuration. d. Choosing Commit updates the running configuration with the contents of the candidate configuration. (T/F) Firewall administrator accounts can be individualized for user needs, granting or restricting permissions as appropriate? a. true b. false a. true Firewall administration can be done using which four interfaces? (Choose four.) a. web interface b. Panorama c. command line interface d. Java API e. XML API a. web interface b. Panorama c. command line interface e. XML API (T/F) Service routes can be used to configure an in-band port to access external services. a. true b. false a. true Virtual routers provide support for static routing and dynamic routing using which three protocols? (Choose three.) a. OSPF b. RIPv2 c. EGP d. BGP a. OSPF b. RIPv2 d. BGP Which three interface types are valid on a Palo Alto Networks firewall? (Choose three.) a. FC b. Layer 3 c. FCoE d. Tap e. Virtual Wire b. Layer 3 d. Tap e. Virtual Wire (T/F) Intrazone traffic is allowed by default but interzone traffic is blocked by default. a. true b. false a. true Which three attributes are true regarding a Virtual Wire (vwire) interface? (Choose three.) a. sometimes called a Bump in the Wire or Transparent In-Line b. no support for routing or device management c. supports NAT, Content-ID, and User-ID d. supports SSL Decrypt Inbound traffic only a. sometimes called a Bump in the Wire or Transparent In-Line b. no support for routing or device management c. supports NAT, Content-ID, and User-ID (T/F) A Layer 3 interface can be configured as dual stack with both IPv4 and IPv6 addresses. a. true b. false a. true Which four items are possible network traffic match criteria in a Security policy on a Palo Alto Networks firewall? (Choose four.) a. Source Zone b. Username c. DNS Domain d. URL e. Application a. Source Zone b. Username d. URL e. Application Which of the three types of Security policy rules that can be created is the default rule type? a. intrazone b. interzone c. universal c. universal (T/F) The intrazone-default and interzone-default rules cannot be modified. a. true b. false b. false Which three items are names of valid source NAT translation types? (Choose three.) a. dynamic IP b. dynamic IP/Port c. port forwarding d. static a. dynamic IP b. dynamic IP/Port d. static (T/F) Logging on intrazone-default and interzone-default Security policy rules is enabled by default. a. true b. false b. false Which item is the name of an object that dynamically groups applications based on application attributes that you define: Category, Subcategory, Technology, Risk, and Characteristic? a. application b. application filter c. application group d. Application Profile b. application filter (T/F) In Palo Alto Networks terms, an application is a specific program or feature that can be detected, monitored, and blocked if necessary. a. true b. false a. true Before App-ID would identify traffic as facebook-base, it would first identify the traffic as which application? a. unknown-tcp b. unknown-udp c. web-browsing c. web-browsing Which three statements are true regarding App-ID? (Choose three.) a. It addresses the traffic classification limitations of traditional firewalls. b. It is the Palo Alto Networks traffic classification mechanism. c. It uses multiple identification mechanisms to determine the exact identity of applications traversing the network. d. It still is in the developmental stage and is not yet released. a. It addresses the traffic classification limitations of traditional firewalls. b. It is the Palo Alto Networks traffic classification mechanism. c. It uses multiple identification mechanisms to determine the exact identity of applications traversing the network. Application groups can contain applications, filters, or other application groups. a. true b. false a. true Which anti-spyware feature enables an administrator to quickly identify a potentially infected host on the network? a. Data Filtering log entry b. continue response page c. DNS sinkhole d. CVE number c. DNS sinkhole (T/F) A Security Profile attached to a Security policy rule is evaluated only if the Security policy rule matches traffic and the rule action is set to "Allow." a. true b. false a. true Zone Protection Profiles are applied to which item? a. ingress ports b. Security policy rules c. egress ports d. Address Groups b. Security policy rules (T/F) The Antivirus Security Profile defines actions to be taken if an infected file is detected as part of an application. a. true b. false a. true (T/F) Each Anti-Spyware Security Profile contains one master rule to handle all types of threats. a. true b. false b. false Which four actions results in a URL Filtering log entry? (Choose four.) a. alert b. allow c. block d. continue e. override a. alert c. block d. continue e. override (T/F) URLs always are matched to a PAN-DB URL category before they match a custom URL category. a. true b. false b. false Which three statements are true regarding Safe Search Enforcement? (Choose three.) a. Safe search is a web server setting. b. Safe search is a web browser setting. c. Safe search is a best-effort setting. d. Safe search is designed to block violent web content. b. Safe search is a web browser setting. c. Safe search is a best-effort setting. d. Safe search is designed to block violent web content. [Show Less]
- Exam
- $20.45
- 0
- 169
PCNSA Questions 1 with complete solution 2023
A Security Policy rule displayed in italic font indicates which condition? The rule is disabled A server profile enables a firewall to locate which s... [Show More] erver type? A server with remote user accounts An Interface management profile can be attached to which two interface types Loopback and Layer 3 Application block pages can be enabled for which applications web-based because a firewall examines every packet in a session, a firewall can detect application_____________? shifts Finding URLs matched to the not-resolved url category in the url filtering log might indicate that you should take which action Validate connectivity to the PAN-DB cloud If a dns sinkhole is configured, any sinkhole actions indicating a potentially infected host are recorded in which log type? threat in a security profile, which action does a firewall take when the profiles action is configured as a reset server The traffic responder is reset for udp sessions, the connection is dropped in a HA configuration which 3 components are synchronized between the pair of firewalls objects policies networks in an HA configuration, which three functions are associated with the HA1 control link? Exchanging HELLOS exchanging Heartbeats synchronizing configurations in an HA configuration, which 2 failure detection methods rely on ICMP pings? heartbeats path monitoring on a firwall that has 32 ethernet ports and it configured with a dynamic IP and Port (DIPP) NAT oversubscription rate of 2x, what is the maximum number of concurrent sessions supported by each available IP? 128K which two user mapping methods are supported by the User-ID integrated agent? WMI probing client probing SSL inbound inspection requires that the firewall be configured with which 2 components? server's private key server's digital certificate the firewall acts as a proxy for which 2 types of traffic? ssl outbound ssl inbound inspection the threat log records events from wich 3 security profiles vulnerability protection antivirus url filtering what are 2 benefits of attaching a decryption profile to a decryption policy no-decrypt rule? expired certificate checking untrusted certificate checking what is a use care for deploying PANetworks NGFW in the public cloud? extending the corporate data center into the public cloud when SSL traffic passes through the firewall, which component is evaluated first? decryption policy where does a GlobalProtect client connect to first when trying to connect to a network? GlobalProtect portal [Show Less]
- Exam
- $13.45
- 0
- 148
PCNSA Questions 2 with correct answers latest 2023
The control plane provides which two managment feature of the firewall? reporting firewall configuration A virtual wire interface that receives a ... [Show More] frame or packet ignores any Layer 2 or layer 3 addresses for switching or routing purposes? True how often are new anti-virus signatures published? daily what does palo alto networks use to regularly post updates for application detection, threat protection, and GlobalProtect data files? dynamic updates which layer 2 interfaces used to switch traffic between? other layer 2 interfaces customized profiles can be used to minimize antivirus inspection for traffic between trusted security zones? true palo alto networks next-generation firewalls are available as physical appliances and in which two other formats? cloud-delivered services virtual machines a final system reboot must be performed to put the new pan-os software into production? true pan-os software supports which two authentication types? kerberos radius palo alto networks NGFW detect known and unknown threats, including those within encrypted traffic, using intelligence generated across many thousands of customer deployments true what are the 2 basic types of NAT? source nat destination nat config logs display entries for which kind of firewall changes? configuration what is the default metric value of static routes? 10 palo alto networks has reduced latency using the single-pass parallel processing (SP3) architecture, which combines which two complementary components? parallel processing hardware single-pass software what does path monitoring use to monitor upstream interfaces on remote, reliable paths? icmp pings palo alto networks provides advanced protection for consistent security across which 2 cloud providers? google cloud platform amazon web services if the NGFW reboots before you commit your changes, how can you revert that candidate config to the current snapshot to restore changes you made between the last commit and the last snapshot? revert to the last saved configuration virtual wire interfaces can be subdivided into virtual wire subinterfaces that can be used to classify traffic according to vlan tags, ip addresse3s, ip ranges or subnets? true what are 2 url filtering security profile actions? allow continue what does the saved named configuration snapshot option do? creates a candidate config snapshopt that does not overwrite the default snapshot (.snapshot.xml) the application framework consists of which 2 components? infrastructure apps which 2 methods can be used to manage pa NGFW web interface xml api what are the 2 components of rule usage? first hit hit count last hit how does global protect cloud service provide NGFW security delivered from the cloud? globally a virtual wire interface is used to pass traffic through a firewall by binding 2 ethernet interfaces? true when safe search enforments is enabled, the firewall blocks search results if the end user is not using the strictest safe search settings in the search query true applications can change during the lifetime of a session true which 2 agents can be used to monitor servers and gather user-id information? built in agent inside the pan-os firewall windows-based client what are two types of security profiles? antivirus url filtering which 3 items are prot of the palo alto networks security operating platform? threat intelligence cloud next-generation firewall advanced endpoint protection what is an application shift an application change during the lifetime of a session a zone protection profile is applied to an ingress zone true cloud security is delivered in which 3 ways api security inline security host security how often are new and modified threat signatures and modified applications signatures published weekly what are 2 dynamic roles? superuser device administrator the data plane provides which 2 data processing features of the firewall? network processing [Show Less]
- Exam
- $14.95
- 0
- 125
Purchase the bundle to get the full access instantly
- 3 Million+ Study Documents
- 100% Money Back Guarantee
- Immediate Download Access
Add To Cart
Reviews 0
Bundle Details
$72.45
- Trusted by 800,000+ Students
- 24/7 Money Back Guarantee
- Download is directly available
152
0
Seller Details
