Palo Alto Networks PCNSA Practice Exams
Last updated on Oct 22,2026- Exam Code: PCNSA
- Exam Name: Palo Alto Networks Certified Network Security Administrator
- Certification Provider: Palo Alto Networks
- Latest update: Oct 22,2026
Drag and Drop Question
Place the following steps in the packet processing order of operations from first to last.
Where can you apply URL Filtering policy in a Security policy rule?
- A . Within the applications selection
- B . Within a destination address
- C . Within a service type
- D . Within the actions tab
An administrator is updating Security policy to align with best practices.
Which Policy Optimizer feature is shown in the screenshot below?
- A . Rules without App Controls
- B . New App Viewer
- C . Rule Usage -Unused
- D . Unused Apps
Your company occupies one floor in a single building. You have two Active Directory domain controllers on a single network. The firewall’s management plane is only slightly utilized.
Which User-ID agent is sufficient in your network?
- A . Windows-based agent deployed on each domain controller
- B . PAN-OS integrated agent deployed on the firewall
- C . Citrix terminal server agent deployed on the network
- D . Windows-based agent deployed on the internal network a domain member
Which update option is not available to administrators?
- A . New Spyware Notifications
- B . New URLs
- C . New Application Signatures
- D . New Malicious Domains
- E . New Antivirus Signatures
How many levels can there be in a device-group hierarchy, below the shared level?
- A . 2
- B . 3
- C . 4
- D . 5
What is a function of application tags?
- A . creation of new zones
- B . application prioritization
- C . automated referenced applications in a policy
- D . IP address allocations in DHCP
Which type of DNS signatures are used by the firewall to identify malicious and command-and-control domains?
- A . DNS Malicious signatures
- B . DNS Security signatures
- C . DNS Malware signatures
- D . DNS Block signatures
A network has 10 domain controllers, multiple WAN links, and a network infrastructure with bandwidth needed to support mission-critical applications. Given the scenario, which type of User-ID agent is considered a best practice by Palo Alto Networks?
- A . Windows-based agent on a domain controller
- B . Captive Portal
- C . Citrix terminal server with adequate data-plane resources
- D . PAN-OS integrated agent
Based on the graphic, what is the purpose of the SSL/TLS Service profile configuration option?
- A . It defines the SSL/TLS encryption strength used to protect the management interface.
- B . It defines the CA certificate used to verify the client’s browser.
- C . It defines the certificate to send to the client’s browser from the management interface.
- D . It defines the firewall’s global SSL/TLS timeout values.