PCNSA Securing Traffic Practice Test 2 — 15 Questions

Question 1

An organization has a security policy that allows all traffic from the corporate user zone to the internet, but they want to block access to social media sites only for a specific group of users in the HR department. What is the best approach?

Accepted Answer

Use user-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it before the allow rule.. Option D is correct because rules are evaluated top-down; the deny rule must come before the allow rule to block the targeted users. Option A lacks user-ID. Option B order is wrong. Option C places deny after allow, so it will never be hit.

Answer

Create an allow rule for all users, then a deny rule for HR with application social-media.

Answer

Create a deny rule for the HR user group with application social-media before the allow rule.

Answer

Use user-ID to identify HR users and create a deny rule with source zone corporate, source user HR, application social-media, action deny, and place it after the allow rule.

Question 2

A firewall administrator wants to ensure that all traffic from the inside zone to the outside zone is inspected for threats, but without causing a bottleneck. Which profile group should be applied to the security rule?

Accepted Answer

Security profile group that includes antivirus, anti-spyware, vulnerability protection, and URL filtering.. Option B is correct because a security profile group combines multiple profiles (antivirus, anti-spyware, vulnerability protection, URL filtering) for comprehensive inspection without significant performance impact. Options A and C are incomplete. Option D is wrong as default does not inspect.

Answer

URL filtering profile only.

Answer

No profile is needed; default settings suffice.

Answer

Antivirus profile only.

Question 3

A company uses Palo Alto Networks firewall and wants to configure NAT to allow internal users to access the internet using a public IP address pool. Which NAT type should be used?

Accepted Answer

Dynamic IP and Port (DIPP) with source NAT.. Option A is correct because Dynamic IP and Port (DIPP) allows many internal IPs to share a pool of public IPs using port address translation. Option B is for static 1-to-1 mapping. Option C is for inbound traffic. Option D is for two-way NAT.

Answer

Bidirectional NAT.

Answer

Static NAT with source NAT.

Answer

Destination NAT with port forwarding.

Question 4

During a security audit, it is discovered that some applications are being incorrectly identified by the Palo Alto Networks firewall. What should the administrator do to improve application identification accuracy?

Accepted Answer

Verify that App-ID updates are current and enable application identification enhancements such as use of application override if needed.. Option C is correct because ensuring App-ID updates are current and using application identification enhancements (like application override when needed) improves accuracy. Option A may help but not directly address misidentification. Option B is possible but not first step. Option D is regressive.

Answer

Enable SSL Decryption to inspect encrypted traffic.

Answer

Change the security policy to use port-based rules instead of application-based.

Answer

Create custom application signatures for the misidentified applications.

Question 5

An administrator needs to block all traffic from a specific IP address on the external interface. What is the simplest method?

Accepted Answer

Create a security rule with source zone, source IP, any destination, and action deny, placed at the top of the rulebase.. Option D is correct because creating a security rule with source zone, source IP, and action deny placed at the top of the rulebase is the direct and simplest method. Option A lacks source zone. Options B and C are more complex and intended for different purposes.

Answer

Use a Zone Protection profile to block the IP.

Answer

Create a security rule with source IP address and action deny.

Answer

Use a DoS protection policy to block the IP.

Question 6

A user reports being unable to access an external FTP server, but other users can access it. The firewall logs show the traffic being denied. What should the administrator check first?

Accepted Answer

User-ID mapping to ensure the user is correctly identified.. Option B is correct because if other users can access the same server, the issue is likely user-specific, and checking user-ID mapping ensures the user is correctly identified and the proper security rules apply. Option A is less likely as other users have same source zone. Option C is external. Option D is not relevant.

Answer

The application override configuration.

Answer

The security rule for the user's source zone.

Answer

The FTP server's health.

Question 7

A company is implementing SSL Decryption with a forward proxy for outbound traffic. They want to ensure that traffic to sensitive sites like banking is not decrypted. What is the correct configuration?

Accepted Answer

Create a decryption exclusion rule for specific URLs or categories.. Option A is correct because decryption exclusion rules can be created for specific URLs or URL categories to bypass decryption. Option B is not practical as it disables decryption globally. Option C is wrong because it decrypts HTTP only, not HTTPS. Option D is not reliable.

Answer

Rely on the browser's security settings to prevent decryption.

Answer

Disable SSL Decryption globally when the user visits sensitive sites.

Answer

Use a policy to decrypt only HTTP traffic.

Question 8

An administrator wants to enforce that only certain approved applications can be used on the network. Which TWO features should be configured?

Accepted Answer

Application-ID. Options A and C are correct. Application-ID identifies and controls applications, while Content-ID controls file transfers and data patterns. User-ID controls user access, URL filtering controls web categories, WildFire analyzes unknown files.

Answer

WildFire

Answer

User-ID

Answer

URL Filtering

Question 9

When creating a security policy to block malware, which THREE profile types should be applied for comprehensive protection?

Accepted Answer

Antivirus. Options A, B, and C are correct. Antivirus blocks known malware, Anti-Spyware blocks spyware and grayware, and Vulnerability Protection blocks exploit attempts. URL Filtering is for categories, File Blocking blocks specific files.

Answer

URL Filtering

Answer

File Blocking

Question 10

An organization uses GlobalProtect for remote access. They want to ensure that only compliant devices can connect. Which TWO GlobalProtect features should be enabled?

Accepted Answer

Host Information Profile (HIP). Options A and C are correct. Host Information Profile (HIP) checks device compliance (OS, antivirus, etc.) and client certificates authenticate the device. Gateway configuration is basic, pre-logon is for always-on, App-IP mapping is not used.

Answer

Gateway configuration

Answer

App-IP mapping

Answer

Pre-logon

Question 11

Based on the exhibit, what will happen to an HTTPS request from an untrust zone user to destination IP 10.1.1.50?

Accepted Answer

Allowed by rule Allow_Web because service tcp/443 matches.. Option C is correct. The rule Allow_Web has application ssl which matches HTTPS, and service tcp/443 matches. So the traffic is allowed. Option A is partially correct but best answer is C because service is explicitly matched. Option B is not hit as the traffic matches Allow_Web first. Option D is incorrect because source is any.

Answer

Denied because the source is not specified in Allow_Web.

Answer

Denied by rule Block_ALL because it is the last rule.

Answer

Allowed by rule Allow_Web because application ssl matches.

Question 12

An administrator notices that SSH tunnels are being blocked by the firewall. According to the exhibit, what is the most likely cause?

Accepted Answer

The policy "Allow_SSH" has tunnel detection set to none, so it does not match.. Option D is correct because tunnel detection set to 'none' on the Allow_SSH policy means the firewall does not detect SSH tunnels, so they are not allowed. The default behavior for application tunnels is to check tunnel detection attributes; without detection, the tunnel policy does not match. Option A is wrong because Block_Tor only blocks Tor. Option B is not necessarily default. Option C is not relevant.

Answer

The application tunnel policy "Block_Tor" is blocking all tunnels.

Answer

The time-to-live setting prevents SSH tunnel detection.

Answer

The default action for application tunnels is deny.

Question 13

Based on the exhibit, what is the role of the rule "Allow_Outbound"?

Accepted Answer

It is a security rule that allows the session.. Option B is correct. The session output shows that the session matched rule Allow_Outbound, which allowed the session. The rule is a security rule, not a decryption rule (that is decrypted-policy), not NAT rule, not QoS rule.

Answer

It is a QoS rule that prioritizes the traffic.

Answer

It is a NAT rule that translates the source IP.

Answer

It is a decryption rule that decrypts the traffic.

Question 14

A security administrator notices that traffic from the internal trust zone to the external untrust zone is being allowed despite a security policy rule explicitly denying that traffic. The rule is present in the policy list and the match conditions seem correct. What is the most likely cause of this issue?

Accepted Answer

There is an allow rule above the deny rule that matches the traffic first.. Option D is correct because any deny rule placed after a matching allow rule will not be evaluated if the allow rule is hit first. Rule order is critical in PAN-OS. Option A is wrong because removing the rule is not the cause. Option B is wrong because policy is not optional. Option C is wrong because implicit deny exists but only if no rule matches.

Answer

The security policy is not enabled on the firewall.

Answer

The deny rule was removed from the configuration.

Answer

The traffic is matching the implicit deny rule at the end.

Question 15

A company wants to block all social media except LinkedIn. Which combination of URL filtering actions should be implemented?

Accepted Answer

Block the social-networking category and allow a custom URL category containing LinkedIn URLs.. Option C is correct because blocking the social-networking category and then creating a custom URL category with LinkedIn's URLs set to allow overrides the block. Option A is wrong because allowing social-networking would allow all social media. Option B is wrong because blocking LinkedIn specifically would also block it. Option D is wrong because alert does not block.

Answer

Alert the social-networking category and block a custom URL category for LinkedIn.

Answer

Block the social-networking category and block a custom URL category for LinkedIn.

Answer

Allow the social-networking category and block a custom URL category for LinkedIn.