Question 1

Which Security profile would you apply to identify infected hosts on the protected network using DNS traffic?

Accepted Answer

Correct answer: C

Question 2

Which attribute can a dynamic address group use as a filtering condition to determine its membership?

Accepted Answer

Dynamic Address Groups: A dynamic address group populates its members dynamically using looks ups for tags and tag-based filters. Dynamic address groups
are very useful if you have an extensive virtual infrastructure where changes in virtual machine location/IP address are frequent. For example, you have a
sophisticated failover setup or provision new virtual machines frequently and would like to apply policy to traffic from or to the new machine without modifying the
configuration/rules on the firewall. https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/objects/objects- address-groups

Question 3

Which User-ID mapping method should be used for an environment with clients that do not authenticate to Windows Active Directory?

Accepted Answer

https://docs.paloaltonetworks.com/pan-os/9-0/pan-os-admin/user-id/map-ip-addresses-to-users/map-ip-addresses-to-usernames-using-captive-portal.html

Question 4

Which two rule types allow the administrator to modify the destination zone? (Choose two )

Accepted Answer

Correct answer: AC

Question 5

Which two configuration settings shown are not the default? (Choose two.)

Accepted Answer

Correct answer: BC

Question 6

You receive notification about a new malware that infects hosts An infection results in the infected host attempting to contact a command-and-control server Which
Security Profile when applied to outbound Security policy rules detects and prevents this threat from establishing a command-and-control connection?

Accepted Answer

Anti-Spyware Security Profiles block spyware on compromised hosts from trying to communicate with external command-and-control (C2) servers, thus enabling
you to detect malicious traffic leaving the network from infected clients.

Question 7

What do you configure if you want to set up a group of objects based on their ports alone?

Certshared now are offering 100% pass ensure PCNSA dumps!
/exam/PCNSA/ (287 Q&As)

Accepted Answer

Correct answer: B

Question 8

All users from the internal zone must be allowed only Telnet access to a server in the DMZ zone. Complete the two empty fields in the Security Policy rules that
permits only this type of access.
Choose two.

Accepted Answer

Correct answer: BC

Question 9

Which built-in IP address EDL would be useful for preventing traffic from IP addresses that are verified as unsafe based on WildFire analysis Unit 42 research and
data gathered from telemetry?

Accepted Answer

? Palo Alto Networks Known Malicious IP Addresses
—Contains IP addresses that are verified malicious based on WildFire analysis, Unit 42 research, and data gathered from telemetry (Share ThreatIntelligence with
Palo Alto Networks). Attackers use these IP addresses almost exclusively to distribute malware, initiate command-and-control activity, and launch attacks.
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/built-in-edls

Question 10

Which action results in the firewall blocking network traffic with out notifying the sender?

Accepted Answer

Correct answer: B