Palo Alto Networks PCNSA Practice Exams
Last updated on Oct 23,2026- Exam Code: PCNSA
- Exam Name: Palo Alto Networks Certified Network Security Administrator
- Certification Provider: Palo Alto Networks
- Latest update: Oct 23,2026
Drag and Drop
Order the steps needed to create a new security zone with a Palo Alto Networks firewall.
Drag and Drop
Order the steps needed to create a new security zone with a Palo Alto Networks firewall.
View the diagram.
What is the most restrictive yet fully functional rule to allow general Internet and SSH traffic into both the DMZ and Untrust/lnternet zones from each of the lOT/Guest and Trust Zones?
A)
B)
C)
D)
- A . Option A
- B . Option B
- C . Option C
- D . Option D
When configuring a security policy, what is a best practice for User-ID?
- A . Use only one method for mapping IP addresses to usernames.
- B . Allow the User-ID agent in zones where agents are not monitoring services.
- C . Limit User-ID to users registered in an Active Directory server.
- D . Deny WMI traffic from the User-ID agent to any external zone.
How does an administrator schedule an Applications and Threats dynamic update while delaying installation of the update for a certain amount of time?
- A . Disable automatic updates during weekdays
- B . Automatically "download and install" but with the "disable new applications" option used
- C . Automatically "download only" and then install Applications and Threats later, after the administrator approves the update
- D . Configure the option for "Threshold"
Which link in the web interface enables a security administrator to view the security policy rules that match new application signatures?
- A . Review Apps
- B . Review App Matches
- C . Pre-analyze
- D . Review Policies
An administrator manages a network with 300 addresses that require translation. The administrator configured NAT with an address pool of 240 addresses and found that connections from addresses that needed new translations were being dropped.
Which type of NAT was configured?
- A . Dynamic IP
- B . Static IP
- C . Dynamic IP and Port
- D . Destination NAT
An administrator manages a network with 300 addresses that require translation. The administrator configured NAT with an address pool of 240 addresses and found that connections from addresses that needed new translations were being dropped.
Which type of NAT was configured?
- A . Dynamic IP
- B . Static IP
- C . Dynamic IP and Port
- D . Destination NAT
An administrator receives a notification about new malware that is being used to attack hosts.
The malware exploits a software bug in a common application.
Which Security Profile will detect and block access to this threat after the administrator updates the firewall’s threat signature database?
- A . Vulnerability Profile applied to inbound Security policy rules
- B . Antivirus Profile applied to outbound Security policy rules
- C . Data Filtering Profile applied to outbound Security policy rules
- D . Data Filtering Profile applied to inbound Security policy rules
Which tab would an administrator click to create an address object?
- A . Objects
- B . Monitor
- C . Device
- D . Policies