CCNA Manage Monitor Operate Questions — Page 2 of 2

MCQeasy

An administrator wants to generate a report that shows the top applications by bandwidth usage over the last week. Which report type should be used to accomplish this?

A.URL Filtering Report

B.Application Report

C.Traffic Report

D.Threat Report

AnswerB

Application Report provides top applications by bandwidth.

Why this answer

The Application Report is designed to provide visibility into application usage, including bandwidth consumption, top applications, and application-level trends over a specified time period. This report type leverages the App-ID engine to classify traffic by application, regardless of port or protocol, making it the correct choice for identifying top applications by bandwidth usage.

Exam trap

The trap here is that candidates often confuse the Traffic Report (which shows raw byte counts) with application-level reporting, failing to realize that only the Application Report uses App-ID to break down bandwidth by application identity rather than by IP or port.

How to eliminate wrong answers

Option A is wrong because the URL Filtering Report focuses on web browsing activity based on URL categories and does not provide application-level bandwidth breakdowns. Option C is wrong because the Traffic Report shows raw traffic volume (bytes, packets, sessions) by source/destination or zone, but it does not natively aggregate or rank by application identity. Option D is wrong because the Threat Report is dedicated to security threats such as intrusions, malware, and vulnerabilities, not application bandwidth usage.

Practice this question →

Matchingmedium

Match each Palo Alto Networks feature to its primary function.

Drag a concept onto its matching description — or click a concept then click the description.

Concepts

Matches

Application identification and control

User and group mapping for policies

Threat prevention including IPS and antivirus

Cloud-based malware analysis

Remote access VPN and mobile security

Why these pairings

The correct matches are: App-ID identifies applications; User-ID maps IPs to users; Content-ID scans content; SSL Decryption decrypts traffic. Common confusions include swapping App-ID and User-ID, or confusing Content-ID with SSL Decryption.

Practice this question →

Multi-Selectmedium

Which THREE of the following are valid actions that can be taken on a dynamic block list entry? (Choose three.)

Select 3 answers

A.Remove an IP address

B.Add an IP address

C.View the list of blocked IPs

D.Add a username to block

E.Convert a dynamic entry to a static entry

AnswersA, B, C

Entries can be removed manually.

Why this answer

The dynamic block list in PAN-OS allows administrators to remove an IP address from the list using the 'delete' action via the CLI or API. This is a standard operation for managing entries that were automatically added by automated threat prevention features like WildFire or AutoFocus.

Exam trap

Palo Alto Networks often tests the misconception that the dynamic block list supports usernames or can convert entries to static, but the list is strictly IP-based and temporary by design.

Practice this question →

Multi-Selecteasy

A systems administrator needs to configure log forwarding to an external syslog server for Security policies. Which two actions are required to achieve this? (Choose two.)

Select 2 answers

A.Create a syslog server profile under Device > Server Profiles > Syslog.

B.Create an SNMP trap profile under Device > Server Profiles > SNMP Trap.

C.Directly apply the syslog server profile to each Security policy rule.

D.Enable log forwarding under the firewall's Device > Setup > Logging and Reporting settings.

E.Create a Log Forwarding profile that references the syslog server profile and apply it to Security policy rules.

AnswersA, E

A syslog server profile is required to define the destination syslog server.

Why this answer

A syslog server profile must first be created under Device > Server Profiles > Syslog to define the external syslog server's IP address, port (default 514), and transport protocol (UDP/TCP). This profile is a prerequisite for any log forwarding to an external syslog server.

Exam trap

The trap here is that candidates mistakenly think a syslog server profile can be applied directly to a Security policy rule, but the PCNSE exam requires understanding that a Log Forwarding profile is the mandatory intermediary object.

Practice this question →

MCQeasy

The traffic log shows a threat severity 'medium' and the threat log shows action 'allow' for the same session. What is the most likely reason that the threat was allowed?

A.The security policy rule that matched this traffic is configured to allow the threat.

B.The action 'allow' in the threat log is misleading; the traffic was actually blocked.

C.The threat was not detected by the firewall.

D.The threat log does not record blocked threats.

AnswerA

The profile for that rule likely has an 'allow' action for this threat.

Why this answer

The threat log shows action 'allow' because the security policy rule that matched the session is configured with an action of 'allow'. When a threat is detected but the security rule permits the traffic, the firewall still allows the session to pass, and the threat is logged with the action taken by the rule. This is a common scenario where the firewall's threat prevention profile is set to 'alert' rather than 'block', or the rule's action overrides the threat action.

Exam trap

The trap here is that candidates assume the threat log action reflects the threat prevention profile's action (e.g., block), but it actually reflects the security policy rule's action, leading them to incorrectly think the threat was not detected or that the log is misleading.

How to eliminate wrong answers

Option B is wrong because the threat log action 'allow' accurately reflects that the firewall permitted the traffic; it is not misleading, as the firewall logs the actual action taken. Option C is wrong because the threat log entry itself confirms that the threat was detected (severity 'medium' is recorded), so the threat was indeed detected. Option D is wrong because the threat log does record blocked threats; if a threat were blocked, the action would show 'block' or 'reset-both', not 'allow'.

Practice this question →