Paloalto Networks PCNSA Exam Questions Free Practice Test

Viewing page 3 out of 11 pages

Viewing questions 21-30 out of questions

Questions # 21:

Which three interface deployment methods can be used to block traffic flowing through the Palo Alto Networks firewall? (Choose three.)

Options:

Layer 2

Virtual Wire

Tap

Layer 3

Expert Solution

Questions # 22:

Place the following steps in the packet processing order of operations from first to last.

Question # 22

Expert Solution

Questions # 23:

Within an Anti-Spyware security profile, which tab is used to enable machine learning based engines?

Options:

Inline Cloud Analysis

Signature Exceptions

Machine Learning Policies

Signature Policies

Expert Solution

Answer

Explanation

An Anti-Spyware security profile is a set of rules that defines how the firewall detects and prevents spyware from compromising hosts on the network. Spyware is a type of malware that collects information from the infected system, such as keystrokes, browsing history, or personal data, and sends it to an external command-and-control (C2) server1.

An Anti-Spyware security profile consists of four tabs: Signature Policies, Signature Exceptions, Machine Learning Policies, and Inline Cloud Analysis1.

The Signature Policies tab allows you to configure the actions and log settings for each spyware signature category, such as adware, botnet, keylogger, phishing, or worm. You can also enable DNS Security to block malicious DNS queries and responses1.

The Signature Exceptions tab allows you to create exceptions for specific spyware signatures that you want to override the default action or log settings. For example, you can allow a signature that is normally blocked by the profile, or block a signature that is normally alerted by the profile1.

The Machine Learning Policies tab allows you to configure the actions and log settings for machine learning based signatures that detect unknown spyware variants. You can also enable WildFire Analysis to submit unknown files to the cloud for further analysis1.

The Inline Cloud Analysis tab allows you to enable machine learning based engines that detect unknown spyware variants in real time. These engines use cloud-based models to analyze the behavior and characteristics of network traffic and identify malicious patterns. You can enable inline cloud analysis for HTTP/HTTPS traffic, SMTP/SMTPS traffic, or IMAP/IMAPS traffic1.

Therefore, the tab that is used to enable machine learning based engines is the Inline Cloud Analysis tab.

References:

1: Security Profile: Anti-Spyware - Palo Alto Networks

Questions # 24:

Which URL Filtering Profile action does not generate a log entry when a user attempts to access a URL?

Options:

override

allow

block

continue

Expert Solution

Questions # 25:

What do dynamic user groups you to do?

Options:

create a QoS policy that provides auto-remediation for anomalous user behavior and malicious activity

create a policy that provides auto-sizing for anomalous user behavior and malicious activity

create a policy that provides auto-remediation for anomalous user behavior and malicious activity

create a dynamic list of firewall administrators

Expert Solution

Questions # 26:

An organization has some applications that are restricted for access by the Human Resources Department only, and other applications that are available for any known user in the organization.

What object is best suited for this configuration?

Options:

Application Group

Tag

External Dynamic List

Application Filter

Expert Solution

Questions # 27:

How would a Security policy need to be written to allow outbound traffic using Secure Shell (SSH) to destination ports tcp/22 and tcp/4422?

Options:

The admin creates a custom service object named "tcp-4422" with port tcp/4422.

The admin then creates a Security policy allowing application "ssh" and service "tcp-4422".

The admin creates a custom service object named "tcp-4422" with port tcp/4422.

The admin then creates a Security policy allowing application "ssh", service "tcp-4422". and service "application-default".

The admin creates a Security policy allowing application "ssh" and service "application-default".

The admin creates a custom service object named "tcp-4422" with port tcp/4422.

The admin also creates a custom service object named "tcp-22" with port tcp/22.

The admin then creates a Security policy allowing application "ssh", service "tcp-4422". and service "tcp-22".

Expert Solution

Questions # 28:

Question # 28

Given the detailed log information above, what was the result of the firewall traffic inspection?

Options:

It was blocked by the Anti-Virus Security profile action.

It was blocked by the Anti-Spyware Profile action.

It was blocked by the Vulnerability Protection profile action.

It was blocked by the Security policy action.

Expert Solution

Questions # 29:

An administrator should filter NGFW traffic logs by which attribute column to determine if the entry is for the start or end of the session?

Options:

Receive Time

Type

Destination

Source

Expert Solution

Questions # 30:

Which Security profile must be added to Security policies to enable DNS Signatures to be checked?

Options:

Anti-Spyware

Antivirus

Vulnerability Protection

URL Filtering

Expert Solution

Viewing page 3 out of 11 pages

Viewing questions 21-30 out of questions

Pass the Paloalto Networks Network Security Administrator PCNSA Questions and answers with CertsForce