Mock P C N S A Exam4

Your company is highly concerned with their intellectual property being accessed by unauthorized resources. There is a mature process to store and include metadata tags for all confidential documents.

Which Security profile can further ensure that these documents do not exit the corporate network?

• File Blocking

• Data Filtering

• Anti-Spyware

• URL Filtering

Answer explanation

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-web-interface-help/objects/objects-security-profiles-data-filtering

Data filtering enables the firewall to detect sensitive information—such as credit card or social security numbers or internal corporate documents—and prevent this data from leaving a secure network. Before you enable data filtering, select Objects > Custom Objects > Data Patterns to define the type of data you want to filter (such as social security numbers or document titles that contain the word “confidential”). You can add several data pattern objects to a single Data Filtering profile and, when attached to a Security policy rule, the firewall scans allowed traffic for each data pattern and blocks matching traffic based on the data filtering profile settings.

Refer to the exhibit. A web server in the DMZ is being mapped to a public address through DNAT.

Which Security policy rule will allow traffic to flow to the web server?

• Untrust (any) to DMZ (10.1.1.100), web browsing - Allow

• Untrust (any) to Untrust (1.1.1.100), web browsing - Allow

• Untrust (any) to Untrust (10.1.1.100), web browsing - Allow

• Untrust (any) to DMZ (1.1.1.100), web browsing - Allow

Answer explanation

the key in this question is Security policy rule, the traffic will flow through the firewall within two rules, Nat rule policy+Security rule policy.

Which Security policy match condition would an administrator use to block traffic from IP addresses on the Palo Alto Networks EDL of Known Malicious IP

Addresses list?

• destination address

• source address

• destination zone

• source zone

Answer explanation

Predefined IP Address—A predefined IP address list is a type of IP address list that refers to the built-in, dynamic IP lists with fixed or “predefined” contents. These Built-In External Dynamic Lists—for bulletproof hosting providers, known malicious, and high-risk IP addresses—are automatically added to your firewall if you have an active Threat Prevention license. A predefined IP address list can also refer to an EDL that uses one of the built-in lists as a source. Because you can’t modify the contents of a predefined list, you can use a predefined list as a source for a different EDL if you want to add or exclude list entries.

https://docs.paloaltonetworks.com/pan-os/10-0/pan-os-admin/policy/use-an-external-dynamic-list-in-policy/external-dynamic-list

Which feature would be useful for preventing traffic from hosting providers that place few restrictions on content whose services are frequently used by attackers to distribute illegal or unethical material?

• Palo Alto Networks C&G IP Addresses

• Palo Alto Networks High Risk IP Addresses

• Palo Alto Networks Known Malicious IP Addresses

• Palo Alto Networks Bulletproof IP Addresses

Answer explanation

Palo Alto Networks Bulletproof IP Addresses—Contains IP addresses provided by bulletproof hosting providers. Because bulletproof hosting providers place few, if any, restrictions on content, attackers frequently use these services to host and distribute malicious, illegal, and unethical material.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PM0pCAG

An administrator is reviewing the Security policy rules shown in the screenshot below.

Which statement is correct about the information displayed?

• Highlight Unused Rules is checked.

• There are seven Security policy rules on this firewall.

• The view Rulebase as Groups is checked.

• Eleven rules use the “Infrastructure” tag.

In order to fulfill the corporate requirement to backup the configuration of Panorama and the Panorama-managed firewalls securely, which protocol should you select when adding a new scheduled config export?

• HTTPS

• SMB v3

• SCP

• FTP

What must be considered with regards to content updates deployed from Panorama?

• Content update schedulers need to be configured separately per device group.

• Panorama can only install up to five content versions of the same type for potential rollback scenarios.

• A PAN-OS upgrade resets all scheduler configurations for content updates.

• Panorama can only download one content update at a time for content updates of the same type.

Answer explanation

Panorama can download only one update at a time for updates of the same type. If you schedule multiple updates of the same type to download during the same time Recurrence, only the first download succeeds.

https://docs.paloaltonetworks.com/pan-os/10-1/pan-os-upgrade/upgrade-panorama/deploy-updates-to-firewalls-log-collectors-and-wildfire-appliances-using-panorama/schedule-a-content-update-using-panorama

Where in Panorama would Zone Protection profiles be configured?

• Templates

• Device Groups

• Shared

• Panorama tab

Answer explanation

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000Clm9CAC

Zone protection can be set using a template configuration to apply similar settings to multiple zones. These settings apply to ingress zone

What is a valid Security Zone type in PAN-OS?

• Management

• Logical

• Transparent

• Tap

Answer explanation

Below are the valid Zone Types

Tap

Virtual Wire

Layer 2

Layer 3

Tunnel

External

What are the requirements for using Palo Alto Networks EDL Hosting Service?

• an additional paid subscription

• any supported Palo Alto Networks firewall or Prisma Access firewall

• a firewall device running with a minimum version of PAN-OS 10.1

• an additional subscription free of charge

Answer explanation

https://docs.paloaltonetworks.com/resources/edl-hosting-service