Palo Alto Networks Certified Network Security Administrator

QUESTION NO: 1
What Policy Optimizer policy view differ from the Security policy do?

A. It shows rules that are missing Security profile configurations. B. It shows rules with the same Source Zones and Destination Zones. C. It indicates that a broader rule matching the criteria is configured above a more specific rule. D. It indicates rules with App-ID that are not configured as port-based.

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
Which two features implement one-to-one translation of a source IP address while allowing the source port to change? (Choose two.)

A. Dynamic IP and Port (DIPP) B. Dynamic IP / Port Fallback C. Dynamic IP D. Static IP

Correct Answer: A,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
What must first be created on the firewall for SAML authentication to be configured?

A. Server Profile B. Server Policy C. Server Location D. Server Group

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
Match each rule type with its example

Correct Answer:

QUESTION NO: 5
Which statement best describes a common use of Policy Optimizer?

A. Policy Optimizer on a VM-50 firewall can display which Layer 7 App-ID Security policies have unused applications. B. Policy Optimizer can display which Security policies have not been used in the last 90 days. C. Policy Optimizer can add or change a Log Forwarding profile for each Security policy selected. D. Policy Optimizer can be used on a schedule to automatically create a disabled Layer 7 App-ID Security policy for every Layer 4 policy that exists. Admins can then manually enable policies they want to keep and delete ones they want to remove.

Correct Answer: B

QUESTION NO: 6
What is an advantage for using application tags?

A. They are helpful during the creation of new zones B. They help with the design of IP address allocations in DHCP. C. They help with the creation of interfaces D. They help content updates automate policy updates

Correct Answer: D

QUESTION NO: 7
How do you reset the hit count on a security policy rule?

A. First disable and then re-enable the rule. B. Type the CLI command reset hitcount <POLICY-NAME>. C. Reboot the data-plane. D. Select a Security policy rule, and then select Hit Count > Reset.

Correct Answer: D

QUESTION NO: 8
What can be achieved by selecting a policy target prior to pushing policy rules from Panorama?

A. Doing so provides audit information prior to making changes for selected policy rules B. Doing so limits the templates that receive the policy rules C. You specify the location as pre can - or post-rules to push policy rules D. You can specify the firewalls m a device group to which to push policy rules

Correct Answer: D

QUESTION NO: 9
Which type of address object is "10 5 1 1/0 127 248 2"?

A. IP range B. IP netmask C. IP wildcard mask D. IP subnet

Correct Answer: C

QUESTION NO: 10
What are two valid selections within an Antivirus profile? (Choose two.)

A. block-ip B. deny C. default D. drop

Correct Answer: C,D

QUESTION NO: 11
What is a default setting for NAT Translated Packets when the destination NAT translation is selected as Dynamic IP (with session distribution)?

A. IP Hash B. Source IP Hash C. Round Robin D. Least Sessions

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 12
A systems administrator momentarily loses track of which is the test environment firewall and which is the production firewall. The administrator makes changes to the candidate configuration of the production firewall, but does not commit the changes. In addition, the configuration was not saved prior to making the changes.
Which action will allow the administrator to undo the changes?

A. Revert to last saved configuration. B. Load configuration version, and choose the first item on the list. C. Load named configuration snapshot, and choose the first item on the list. D. Revert to running configuration.

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

Palo Alto Networks Certified Network Security Administrator - PCNSA Exam Questions