PCNSA問題集、Palo Alto Networks実際の試験問題

質問 1

The NetSec Manager asked to create a new firewall Local Administrator profile with customized privileges named NewAdmin. This new administrator has to authenticate without inserting any username or password to access the WebUI.
What steps should the administrator follow to create the New_Admin Administrator profile?

A. 1. Set the Authentication profile to Local.
2. Select the "Use only client certificate authentication" check box.
3. Set Role to Role Based.

B. 1. Select the "Use only client certificate authentication" check box.
2. Set Role to Dynamic.
3. Issue to the Client a Certificate with Certificate Name = NewAdmin

C. 1. Select the "Use only client certificate authentication" check box.
2. Set Role to Dynamic.
3. Issue to the Client a Certificate with Common Name = New Admin

D. 1. Select the "Use only client certificate authentication" check box.
2. Set Role to Role Based.
3. Issue to the Client a Certificate with Common Name = NewAdmin

正解: B

質問 2

Which action can be set in a URL Filtering Security profile to provide users temporary access to all websites in a given category using a provided password?

A. continue

B. exclude

C. override

D. hold

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 3

Which statement is true regarding a Best Practice Assessment?

A. The assessment, guided by an experienced sales engineer, helps determine the areas of greatest risk where you should focus prevention activities

B. It provides a set of questionnaires that help uncover security risk prevention gaps across all areas of network and security architecture

C. The BPA tool can be run only on firewalls

D. It provides a percentage of adoption for each assessment data

正解: A

質問 4

An administrator wants to prevent access to media content websites that are risky Which two URL categories should be combined in a custom URL category to accomplish this goal? (Choose two)

A. streaming-media

B. high-risk

C. known-risk

D. recreation-and-hobbies

正解: A,D

質問 5

All users from the internal zone must be allowed only Telnet access to a server in the DMZ zone. Complete the two empty fields in the Security Policy rules that permits only this type of access.

Choose two.

A. Application = "Telnet"

B. Service - "application-default"

C. Application = "any"

D. Service = "any"

正解: A,B

質問 6

Which two features can be used to tag a user name so that it is included in a dynamic user group? (Choose two)

A. XML API

B. User-ID Windows-based agent

C. GlobalProtect agent

D. log forwarding auto-tagging

正解: A,B

解説: (PassTest メンバーにのみ表示されます)

質問 7

Which type of administrative role must you assign to a firewall administrator account, if the account must include a custom set of firewall permissions?

A. Multi-Factor Authentication

B. Role-based

C. SAML

D. Dynamic

正解: B

質問 8

A network administrator creates an intrazone security policy rule on a NGFW. The source zones are set to IT.
Finance, and HR.
To which two types of traffic will the rule apply? (Choose two.)

A. Within zone IT

B. Between zone IT and zone Finance

C. Within zone HR

D. Between zone IT and zone HR

正解: A,C

解説: (PassTest メンバーにのみ表示されます)

質問 9

What must be considered with regards to content updates deployed from Panorama?

A. Content update schedulers need to be configured separately per device group.

B. Panorama can only install up to five content versions of the same type for potential rollback scenarios.

C. Panorama can only download one content update at a time for content updates of the same type.

D. A PAN-OS upgrade resets all scheduler configurations for content updates.

正解: C

質問 10

Which feature enables an administrator to review the Security policy rule base for unused rules?

A. Policy Optimizer

B. Security policy tags

C. Test Policy Match

D. View Rulebase as Groups

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 11

At which stage of the cyber-attack lifecycle would the attacker attach an infected PDF file to an email?

A. explotation

B. installation

C. delivery

D. reinsurance

E. command and control

正解: C

質問 12

Complete the statement. A security profile can block or allow traffic____________

A. on unknown-tcp or unknown-udp traffic

B. after it is matched by a security policy that allows or blocks traffic

C. before it is matched by a security policy

D. after it is matched by a security policy that allows traffic

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 13

In which two Security Profiles can an action equal to the block IP feature be configured? (Choose two.)

A. Vulnerability Protection

B. Anti-spyware

C. URL Filtering

D. Antivirus

正解: A,B

解説: (PassTest メンバーにのみ表示されます)

Palo Alto Networks Certified Network Security Administrator - PCNSA 模擬練習