Palo Alto Networks PCNSA Practice Exams
Last updated on Oct 22,2026- Exam Code: PCNSA
- Exam Name: Palo Alto Networks Certified Network Security Administrator
- Certification Provider: Palo Alto Networks
- Latest update: Oct 22,2026
Which type of security rule will match traffic between the Inside zone and Outside zone, within the Inside zone, and within the Outside zone?
- A . global
- B . intrazone
- C . interzone
- D . universal
Which type of address object is `10.5.1.1/0.127.248.2`?
- A . IP subnet
- B . IP wildcard mask
- C . IP netmask
- D . IP range
Which type of address object is `10.5.1.1/0.127.248.2`?
- A . IP subnet
- B . IP wildcard mask
- C . IP netmask
- D . IP range
Which action related to App-ID updates will enable a security administrator to view the existing security policy rule that matches new application signatures?
- A . Review Policies
- B . Review Apps
- C . Pre-analyze
- D . Review App Matches
Which action results in the firewall blocking network traffic without notifying the sender?
- A . Drop
- B . Deny
- C . Reset Server
- D . Reset Client
Refer to the exhibit. A web server in the DMZ is being mapped to a public address through DNAT.
Which Security policy rule will allow traffic to flow to the web server?
- A . Untrust (any) to DMZ (10.1.1.100), web browsing -Allow
- B . Untrust (any) to Untrust (1.1.1.100), web browsing -Allow
- C . Untrust (any) to Untrust (10.1.1.100), web browsing -Allow
- D . Untrust (any) to DMZ (1.1.1.100), web browsing -Allow
A website is unexpectedly allowed due to miscategorization.
What are two ways to resolve this issue for a proper response? (Choose two.)
- A . Create a URL category and assign the affected URL.
Update the active URL Filtering profile site access setting for the custom URL category to block. - B . Review the categorization of the website on https://urlfiltering paloaltonetworks.com.
Submit for "request change", identifying the appropriate categorization, and wait for confirmation before testing again. - C . Identify the URL category being assigned to the website.
Edit the active URL Filtering profile and update that category’s site access settings to block. - D . Create a URL category and assign the affected URL.
Add a Security policy with a URL category qualifier of the custom URL category below the original policy.
Set the policy action to Deny.
Which firewall plane provides configuration, logging, and reporting functions on a separate processor?
- A . control
- B . network processing
- C . data
- D . security processing
You notice that protection is needed for traffic within the network due to malicious lateral movement activity.
Based on the image shown, which traffic would you need to monitor and block to mitigate the malicious activity?
- A . branch office traffic
- B . north-south traffic
- C . perimeter traffic
- D . east-west traffic
An administrator needs to allow users to use their own office applications.
How should the administrator configure the firewall to allow multiple applications in a dynamic environment?
- A . Create an Application Filter and name it Office Programs, the filter it on the business-systems category, office-programs subcategory
- B . Create an Application Group and add business-systems to it
- C . Create an Application Filter and name it Office Programs, then filter it on the business-systems category
- D . Create an Application Group and add Office 365, Evernote, Google Docs, and Libre Office