Palo Alto Networks Certified Network Security Administrator (PCNSA) Exam Questions and Answers

The latest Palo Alto Networks Certified Network Security Administrator (PCNSA) certification actual real practice exam question and answer (Q&A) dumps are available free, which are helpful for you to pass the Palo Alto Networks Certified Network Security Administrator (PCNSA) exam and earn Palo Alto Networks Certified Network Security Administrator (PCNSA) certification.

Exam Question 21

Given the topology, which zone type should zone A and zone B to be configured with?

Given the topology, which zone type should zone A and zone B to be configured with?

A. Layer3
B. Tap
C. Layer2
D. Virtual Wire
Correct Answer:
A. Layer3

Exam Question 22

The CFO found a USB drive in the parking lot and decide to plug it into their corporate laptop. The USB drive had malware on it that loaded onto their computer and then contacted a known command and control (CnC) server, which ordered the infected machine to begin Exfiltrating data from the laptop.
Which security profile feature could have been used to prevent the communication with the CnC server?

A. Create an anti-spyware profile and enable DNS Sinkhole
B. Create an antivirus profile and enable DNS Sinkhole
C. Create a URL filtering profile and block the DNS Sinkhole category
D. Create a security policy and enable DNS Sinkhole
Correct Answer:
A. Create an anti-spyware profile and enable DNS Sinkhole

Exam Question 23

Given the image, which two options are true about the Security policy rules. (Choose two.)

Given the image, which two options are true about the Security policy rules. (Choose two.)

A. The Allow Office Programs rule is using an Application Filter
B. In the Allow FTP to web server rule, FTP is allowed using App-ID
C. The Allow Office Programs rule is using an Application Group
D. In the Allow Social Networking rule, allows all of Facebook’s functions
Correct Answer:
B. In the Allow FTP to web server rule, FTP is allowed using App-ID
C. The Allow Office Programs rule is using an Application Group

Exam Question 24

Which type of Security policy rule would match traffic flowing between the Inside zone and Outside zone, within the Inside zone, and within the Outside zone?

A. global
B. intrazone
C. interzone
D. universal
Correct Answer:
D. universal

Exam Question 25

Which Palo Alto Networks firewall security platform provides network security for mobile endpoints by inspecting traffic deployed as internet gateways?

A. GlobalProtect
B. AutoFocus
C. Aperture
D. Panorama
Correct Answer:
A. GlobalProtect

Exam Question 26

Which two statements are correct regarding multiple static default routes when they are configured as shown in the image? (Choose two.)

Which two statements are correct regarding multiple static default routes when they are configured as shown in the image?

A. Path monitoring does not determine if route is useable.
B. Route with highest metric is actively used.
C. Path monitoring determines if route is useable.
D. Route with lowest metric is actively used.
Correct Answer:
C. Path monitoring determines if route is useable.
D. Route with lowest metric is actively used.

Exam Question 27

Which file is used to save the running configuration with a Palo Alto Networks firewall?

A. running-config.xml
B. run-config.xml
C. running-configuration.xml
D. run-configuration.xml
Correct Answer:
A. running-config.xml

Exam Question 28

Which Palo Alto Networks component provides consolidated policy creation and centralized management?

A. GlobalProtect
B. Panorama
C. Prisma SaaS
D. AutoFocus
Correct Answer:
B. Panorama

Exam Question 29

Which five Zero Trust concepts does a Palo Alto Networks firewall apply to achieve an integrated approach to prevent threats? (Choose five.)

A. User identification
B. Filtration protection
C. Vulnerability protection
D. Antivirus
E. Application identification
F. Anti-spyware
Correct Answer:
A. User identification
C. Vulnerability protection
D. Antivirus
E. Application identification
F. Anti-spyware

Exam Question 30

The PowerBall Lottery has reached a high payout amount and a company has decided to help employee morale by allowing employees to check the number, but doesn’t want to unblock the gambling URL category.
Which two methods will allow the employees to get to the PowerBall Lottery site without the company unlocking the gambling URL category? (Choose two.)

A. Add all the URLs from the gambling category except powerball.com to the block list and then set the action for the gambling category to allow.
B. Manually remove powerball.com from the gambling URL category.
C. Add *.powerball.com to the allow list
D. Create a custom URL category called PowerBall and add *.powerball.com to the category and set the action to allow.
Correct Answer:
C. Add *.powerball.com to the allow list
D. Create a custom URL category called PowerBall and add *.powerball.com to the category and set the action to allow.