The Renovate Guide To PCNSA Training Materials

NEW QUESTION 1
An administrator receives a global notification for a new malware that infects hosts. The infection will result in the infected host attempting to contact a command-and-control (C2) server. Which two security profile components will detect and prevent this threat after the firewall’s signature database has been updated? (Choose two.)

• A. vulnerability protection profile applied to outbound security policies
• B. anti-spyware profile applied to outbound security policies
• C. antivirus profile applied to outbound security policies
• D. URL filtering profile applied to outbound security policies

Answer: BD

NEW QUESTION 2
The CFO found a USB drive in the parking lot and decide to plug it into their corporate laptop. The USB drive had malware on it that loaded onto their computer and then contacted a known command and control (CnC) server, which ordered the infected machine to begin Exfiltrating data from the laptop.
Which security profile feature could have been used to prevent the communication with the CnC server?

• A. Create an anti-spyware profile and enable DNS Sinkhole
• B. Create an antivirus profile and enable DNS Sinkhole
• C. Create a URL filtering profile and block the DNS Sinkhole category
• D. Create a security policy and enable DNS Sinkhole

Answer: A

NEW QUESTION 3
Which two Palo Alto Networks security management tools provide a consolidated creation of policies, centralized management and centralized threat intelligence. (Choose two.)

• A. GlobalProtect
• B. Panorama
• C. Aperture
• D. AutoFocus

Answer: BD

NEW QUESTION 4
Which five Zero Trust concepts does a Palo Alto Networks firewall apply to achieve an integrated approach to prevent threats? (Choose five.)

• A. User identification
• B. Filtration protection
• C. Vulnerability protection
• D. Antivirus
• E. Application identification
• F. Anti-spyware

Answer: ACDEF

NEW QUESTION 5
Which type of security rule will match traffic between the Inside zone and Outside zone, within the Inside zone, and within the Outside zone?

• A. global
• B. intrazone
• C. interzone
• D. universal

Answer: D

NEW QUESTION 6
Which User-ID mapping method should be used for an environment with clients that do not authenticate to Windows Active Directory?

• A. Windows session monitoring via a domain controller
• B. passive server monitoring using the Windows-based agent
• C. Captive Portal
• D. passive server monitoring using a PAN-OS integrated User-ID agent

Answer: C

NEW QUESTION 7
An administrator needs to allow users to use their own office applications. How should the administrator configure the firewall to allow multiple applications in a dynamic environment?

• A. Create an Application Filter and name it Office Programs, the filter it on the business-systems category, office-programs subcategory
• B. Create an Application Group and add business-systems to it
• C. Create an Application Filter and name it Office Programs, then filter it on the business-systems category
• D. Create an Application Group and add Office 365, Evernote, Google Docs, and Libre Office

Answer: B

NEW QUESTION 8
Which administrator type utilizes predefined roles for a local administrator account?

• A. Superuser
• B. Role-based
• C. Dynamic
• D. Device administrator

Answer: C

NEW QUESTION 9
Which statement is true regarding a Prevention Posture Assessment?

• A. The Security Policy Adoption Heatmap component filters the information by device groups, serial numbers, zones, areas of architecture, and other categories
• B. It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture
• C. It provides a percentage of adoption for each assessment area
• D. It performs over 200 security checks on Panorama/firewall for the assessment

Answer: B

NEW QUESTION 10
Users from the internal zone need to be allowed to Telnet into a server in the DMZ zone. Complete the security policy to ensure only Telnet is allowed.
Security Policy: Source Zone: Internal to DMZ Zone services “Application defaults”, and action = Allow

• A. Destination IP: 192.168.1.123/24
• B. Application = ‘Telnet’
• C. Log Forwarding
• D. USER-ID = ‘Allow users in Trusted’

Answer: B

NEW QUESTION 11
Which two statements are correct about App-ID content updates? (Choose two.)

• A. Updated application content may change how security policy rules are enforced
• B. After an application content update, new applications must be manually classified prior to use
• C. Existing security policy rules are not affected by application content updates
• D. After an application content update, new applications are automatically identified and classified

Answer: CD

NEW QUESTION 12
How many zones can an interface be assigned with a Palo Alto Networks firewall?

• A. two
• B. three
• C. four
• D. one

Answer: BC

Explanation:
5. Which two configuration settings shown are not the default? (Choose two.)
A. Enable Security Log
B. Server Log Monitor Frequency (sec)
C. Enable Session
D. Enable Probing

NEW QUESTION 13
When creating a Source NAT policy, which entry in the Translated Packet tab will display the options Dynamic IP and Port, Dynamic, Static IP, and None?

• A. Translation Type
• B. Interface
• C. Address Type
• D. IP Address

Answer: A

NEW QUESTION 14

Given the image, which two options are true about the Security policy rules. (Choose two.)

• A. The Allow Office Programs rule is using an Application Filter
• B. In the Allow FTP to web server rule, FTP is allowed using App-ID
• C. The Allow Office Programs rule is using an Application Group
• D. In the Allow Social Networking rule, allows all of Facebook’s functions

Answer: BC

NEW QUESTION 15
Which firewall plane provides configuration, logging, and reporting functions on a separate processor?

• A. control
• B. network processing
• C. data
• D. security processing

Answer: A

NEW QUESTION 16
Given the topology, which zone type should zone A and zone B to be configured with?

• A. Layer3
• B. Tap
• C. Layer2
• D. Virtual Wire

Answer: A

NEW QUESTION 17
Which two App-ID applications will need to be allowed to use Facebook- chat? (Choose two.)

• A. facebook
• B. facebook-chat
• C. facebook-base
• D. facebook-email

Answer: BC

NEW QUESTION 18
DRAG DROP
Match the Palo Alto Networks Security Operating Platform architecture to its description.
Select and Place:

• A. Mastered
• B. Not Mastered

Answer: A

Explanation:

NEW QUESTION 19
......