Palo Alto Networks PCNSA Practice Exams
Last updated on Oct 23,2026- Exam Code: PCNSA
- Exam Name: Palo Alto Networks Certified Network Security Administrator
- Certification Provider: Palo Alto Networks
- Latest update: Oct 23,2026
Which two statements apply to an Advanced Threat Prevention subscription? (Choose two.)
- A . It contains all the features already in a Threat Prevention subscription.
- B . It provides the ability to identify evasive and previously unseen command-and-control (C2) threats.
- C . When it is active, a WildFire profile is no longer needed.
- D . Due to its more advanced signatures, it provides the ability to identify new threats.
An administrator would like to block traffic to all high risk audio streaming applications, including new App-IDs introduced with content updates.
Which filter should the administrator configure in the application filter object?
- A . The category is media, and the characteristic includes Evasive.
- B . The subcategory is audio-streaming, and the risk is 1.
- C . The subcategory is audio-streaming, and the risk is 5.
- D . The category is media, and the tag is high risk.
Which rule type is appropriate for matching traffic occurring within a specified zone?
How should the administrator configure the firewall to restrict users to specific email applications?
- A . Create an application filter and filter it on the collaboration category.
- B . Create an application filter and filter it on the collaboration category, email subcategory.
- C . Create an application group and add the email applications to it.
- D . Create an application group and add the email category to it.
Which data flow direction is protected in a zero-trust firewall deployment that is not protected in a perimeter-only firewall deployment?
- A . north-south
- B . inbound
- C . outbound
- D . east-west
By default, which action is assigned to the interzone-default rule?
- A . Reset-client
- B . Allow
- C . Reset-server
- D . Deny
An administrator wishes to follow best practices for logging traffic that traverses the firewall.
Which log setting is correct?
- A . Enable Log at Session Start
- B . Disable all logging
- C . Enable Log at both Session Start and End
- D . Enable Log at Session End
An administrator wishes to follow best practices for logging traffic that traverses the firewall.
Which log setting is correct?
- A . Enable Log at Session Start
- B . Disable all logging
- C . Enable Log at both Session Start and End
- D . Enable Log at Session End
You receive notification about a new malware that infects hosts. An infection results in the infected host attempting to contact a command-and-control server.
Which Security Profile detects and prevents this threat from establishing a command-and-control
connection?
- A . Vulnerability Protection Profile applied to outbound Security policy rules.
- B . Anti-Spyware Profile applied to outbound security policies.
- C . Antivirus Profile applied to outbound Security policy rules
- D . Data Filtering Profile applied to outbound Security policy rules.
Recently changes were made to the firewall to optimize the policies and the security team wants to see if those changes are helping.
What is the quickest way to reset the hit counter to zero in all the security policy rules?
- A . At the CLI enter the command reset rules and press Enter
- B . Highlight a rule and use the Reset Rule Hit Counter > Selected Rules for each rule
- C . Reboot the firewall
- D . Use the Reset Rule Hit Counter > All Rules option
An administrator creates a new Security policy rule to allow DNS traffic from the LAN to the DMZ zones. The administrator does not change the rule type from its default value.
What type of Security policy rule is created?
- A . Intrazone
- B . Interzone
- C . Universal
- D . Tagged