PCNSA Practice Test 8 — 10 Questions

Question 1

An administrator needs to allow inbound SMTP traffic to a mail server located in the DMZ. The firewall has a public IP address on the external interface. Which configuration is necessary to ensure the mail server receives the traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a Destination NAT rule and a security policy rule allowing SMTP from external to DMZ.. To allow inbound SMTP traffic from the internet to a mail server in the DMZ, the firewall must perform Destination NAT (DNAT) to translate the public IP address on the external interface to the private IP address of the mail server. A corresponding security policy rule must permit SMTP (TCP port 25) traffic from the external zone to the DMZ zone. Without DNAT, the firewall would not know which internal server should receive the traffic, and without the security rule, the traffic would be blocked.

Answer

Configure a Source NAT rule to translate the mail server's IP to the public IP.

Answer

Configure a security policy rule with source NAT to translate the public IP to the private IP.

Answer

Configure a security policy rule allowing SMTP from external to DMZ without NAT.

Question 2

A company uses Panorama to manage multiple device groups. They want to push a set of global security policies to all firewalls. Where should the administrator configure these policies in Panorama?

Accepted Answer

As pre-rules in the 'shared' device group. In Panorama, the 'shared' device group is designed for policies that must apply globally across all managed firewalls. Configuring security policies as pre-rules in the shared device group ensures they are evaluated before any device-group-specific rules, providing a consistent global baseline that cannot be overridden by local rules.

Answer

As pre-rules in each regional device group

Answer

In the default rule base of each device group

Answer

As post-rules in the 'shared' device group

Question 3

An organization is deploying a Palo Alto Networks firewall in a data center to segment traffic between three application tiers: web, app, and database. The web servers must be accessible from the internet, the app servers must only be reachable from the web servers, and the database servers must only be reachable from the app servers. Which security policy design best meets these requirements?

Accepted Answer

Create three zones: Web, App, DB. Create rules that allow only necessary protocols (e.g., HTTP/HTTPS from internet to Web, specific ports from Web to App, and specific ports from App to DB).. It implements a least-privilege security model using Palo Alto Networks zones and granular application- and port-based rules. By creating separate zones (Web, App, DB) and explicitly allowing only the necessary protocols (e.g., HTTP/HTTPS from the internet to Web, specific ports from Web to App, and specific ports from App to DB), the firewall enforces strict segmentation and minimizes the attack surface. This design leverages the zone-based security paradigm of PAN-OS to control inter-zone traffic precisely, aligning with the principle of zero trust.

Answer

Create three zones: Web, App, DB. Allow all traffic from Web to App and App to DB, and block all other inter-zone traffic.

Answer

Place web servers in an untrust zone and app/database in a trust zone, then allow all traffic from trust to untrust.

Answer

Place all servers in the same zone and use rules to allow traffic between them.

Question 4

Which TWO security profile types are used to block known malware? (Choose two.)

Accepted Answer

File Blocking. The correct answers are A (File Blocking) and D (Antivirus). Antivirus blocks known malware by comparing files against signature databases. File Blocking prevents specific file types (e.g., executables, archives) from being transferred, which can stop malware delivery. URL Filtering (B) controls web access based on categories, not malware blocking. Anti-Spyware (C) targets spyware specifically, not all known malware. Vulnerability Protection (E) blocks exploit attempts, not malware files themselves.

Answer

URL Filtering

Answer

Anti-Spyware

Answer

Vulnerability Protection

Question 5

A financial services company uses a Palo Alto Networks firewall to protect its customer data. They have a requirement to block all file transfers that contain credit card numbers (PCI compliance). The firewall has Data Filtering profiles configured to detect credit card patterns. However, the security team notices that some file transfers containing credit card numbers are not being blocked. The traffic logs show the applications are identified correctly, and the security rule has the Data Filtering profile attached. The Data Filtering profile is configured with a rule to block 'Credit Card Numbers' with a threshold of 1. What could be the issue?

Accepted Answer

The Data Filtering profile does not include the specific applications that are transferring files.. Data Filtering profiles are applied per application. If the specific applications used for file transfers (e.g., custom or less common apps) are not selected within the Data Filtering profile, the firewall will not inspect those transfers for credit card numbers, even if the security rule has the profile attached. The profile must explicitly include the applications to enforce the data filtering rules.

Answer

The Data Filtering profile is not attached to the security rule.

Answer

The security rule is not logging the Data Filtering alerts.

Answer

SSL decryption is not enabled for the traffic.

Question 6

An administrator needs to block all traffic from a specific application that uses multiple ports. Which TWO methods can achieve this? (Choose two.)

Accepted Answer

Create a security rule with the application and action 'deny'.. App-ID identifies traffic based on application signatures, not just ports. By creating a security rule with the specific application and setting the action to 'deny', the firewall blocks all traffic matching that application regardless of the ports or protocols it uses. This is the most precise and effective method to block an application that uses multiple ports.

Answer

Block the common ports used by the application.

Answer

Disable App-ID on the zone to prevent inspection.

Answer

Create a security rule allowing the application but with a limit.

Question 7

A user reports that they cannot download PDF files from a corporate web application. The security policy has a File Blocking Profile applied to deny 'PDF' files. The web application uses 'ssl' and 'web-browsing' apps. What should the administrator verify first?

Accepted Answer

Confirm that the File Blocking Profile is applied to the correct applications (ssl and web-browsing) in the security rule.. File Blocking Profiles are applied per application in a security rule. The administrator must first verify that the profile is attached to the correct applications (ssl and web-browsing) that the web application uses; otherwise, the file blocking will not be enforced for those applications, even if the profile itself is configured correctly.

Answer

Ensure the security rule includes the application 'pdf-download' in the Application list.

Answer

Check that the File Blocking Profile has 'PDF' selected under 'File Types to Block'.

Answer

Verify the URL Category of the web application is included in the rule.

Question 8

Match each firewall deployment mode to its description.

Accepted Answer

Virtual Wire mode: Pairs two interfaces to act as a wire, forwarding traffic transparently.. The correct matches are: Layer 2 mode is a transparent bridge based on MAC addresses; Virtual Wire mode pairs interfaces as a wire; Layer 3 mode routes based on IP; Tap mode passively monitors. Common confusions involve swapping Layer 2 and Virtual Wire definitions, or confusing Tap with Layer 3.

Answer

Layer 3 mode: Acts as a transparent bridge, forwarding traffic based on MAC addresses.

Answer

Tap mode: Routes traffic between different subnets using IP addresses.

Answer

Tap mode: Forwards traffic based on MAC addresses transparently.

Question 9

Which Content-ID feature can be used to prevent credit card numbers from being sent via webmail applications?

Accepted Answer

Data Filtering Profile. Data Filtering Profile is the correct Content-ID feature because it allows you to define custom patterns, such as regular expressions, to match sensitive data like credit card numbers. When a webmail application attempts to send an email containing a matching pattern, the firewall can block or alert on the transaction, preventing data exfiltration.

Answer

URL Filtering Profile

Answer

Application Override

Answer

File Blocking Profile

Question 10

Which TWO methods can be used to create a custom App-ID signature?

Accepted Answer

Using a packet buffer override.. A packet buffer override is a method used to create a custom App-ID signature by capturing and analyzing the payload of a specific application's traffic. This allows the firewall to identify the application based on unique byte sequences or patterns in the packet payload, which is essential for applications that use non-standard ports or encryption.

Answer

Using a Data Filtering profile.

Answer

Using a URL Filtering profile.

Answer

Using a custom application signature with a port match.