[2025年01月06日] 最新リアルPCNSA試験問題集解答 [Q156-Q176]

[2025年01月06日] 最新リアルPCNSA試験問題集解答

あなたを簡単に合格させるPCNSA試験問と正確なPalo Alto Networks Certified Network Security AdministratorPDF問題

PCNSA認定は、ネットワークセキュリティの専門家に多くの利点を提供します。まず第一に、企業のネットワークセキュリティで広く使用されているPalo Alto Networks製品を管理する知識とスキルが証明されます。第二に、この認定は業界標準の知識とスキルを維持することへの専門家としての取り組みを示し、プロフェッショナルの評判を高めることができます。最後に、PCNSA認定は、ネットワークセキュリティの専門家にとって貴重な資格として多くの組織に認められているため、キャリアアップの機会や高い給与をもたらす可能性があります。

質問 # 156
Where in Panorama Would Zone Protection profiles be configured?

A. Panorama tab
B. Device Groups
C. Shared
D. Templates

正解：D

解説：
https://docs.paloaltonetworks.com/panorama/9-1/panorama-admin/manage-firewalls/use-case-configure-firewall

質問 # 157
Which attribute can a dynamic address group use as a filtering condition to determine its membership?

A. tag
B. subnet mask
C. wildcard mask
D. IP address

正解：A

解説：
Dynamic Address Groups: A dynamic address group populates its members dynamically using looks ups for tags and tag-based filters. Dynamic address groups are very useful if you have an extensive virtual infrastructure where changes in virtual machine location/IP address are frequent.
For example, you have a sophisticated failover setup or provision new virtual machines frequently and would like to apply policy to traffic from or to the new machine without modifying the configuration/rules on the firewall.
https://docs.paloaltonetworks.com/pan-os/8-1/pan-os-web-interface-help/objects/objects-address- groups

質問 # 158
View the diagram. What is the most restrictive yet fully functional rule to allow general Internet and SSH traffic into both the DMZ and Untrust/lnternet zones from each of the lOT/Guest and Trust Zones?

正解：A

質問 # 159
An administrator is updating Security policy to align with best practices.

Which Policy Optimizer feature is shown in the screenshot below?

A. New App Viewer
B. Unused Apps
C. Rules without App Controls
D. Rule Usage - Unused

正解：C

解説：
https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-admin/app-id/security-policy-rule- optimization/migrate-port-based-to-app-id-based-security-policy-rules

質問 # 160
Which policy set should be used to ensure that a policy is applied just before the default security rules?

A. Shared post-rulebase
B. Local firewall policy
C. Child device-group post-rulebase
D. Parent device-group post-rulebase

正解：A

解説：
Order:
Shared pre-rules
Device group pre-rules
Local firewall rules
Device group post-rules
Shared post-rules
Intrazone-default
Interzone-default

質問 # 161
Based on the screenshot what is the purpose of the included groups?

A. They are groups that are imported from RADIUS authentication servers.
B. They contain only the users you allow to manage the firewall.
C. They are only groups visible based on the firewall's credentials.
D. They are used to map usernames to group names.

正解：A

質問 # 162
Starting with PAN-OS version 9.1, which new type of object is supported for use within the User field of a Security policy rule?

A. static user group
B. remote username
C. dynamic user group
D. local username

正解：C

質問 # 163
An administrator creates a new Security policy rule to allow DNS traffic from the LAN to the DMZ zones. The administrator does not change the rule type from its default value.
What type of Security policy rule is created?

A. Tagged
B. Universal
C. Intrazone
D. Interzone

正解：B

解説：
Policy > Security > Add
Rule type: Universal (default)

質問 # 164
Which feature would be useful for preventing traffic from hosting providers that place few restrictions on content, whose services are frequently used by attackers to distribute illegal or unethical material?

A. Palo Alto Networks Known Malicious IP Addresses
B. Palo Alto Networks High-Risk IP Addresses
C. Palo Alto Networks C&C IP Addresses
D. Palo Alto Networks Bulletproof IP Addresses

正解：D

解説：
To block hosts that use bulletproof hosts to provide malicious, illegal, and/or unethical content, use the bulletproof IP address list in policy.
https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PM0pCAG

質問 # 165
What are three valid ways to map an IP address to a username? (Choose three.)

A. DHCP Relay logs
B. WildFire verdict reports
C. using the XML API
D. usernames inserted inside HTTP Headers
E. a user connecting into a GlobalProtect gateway using a GlobalProtect Agent

正解：C、D、E

解説：
Palo Alto Networks firewalls can map IP addresses to usernames using various methods, such as User-ID agents, Captive Portal, GlobalProtect, XML API, and HTTP headers. These methods allow the firewall to enforce security policies based on user identity, rather than just IP address. Some of these methods are:
Using the XML API: The XML API allows external systems to send user mapping information to the firewall using HTTPS requests. The firewall can then use this information to identify the users behind the IP addresses and apply the appropriate policies1.
A user connecting into a GlobalProtect gateway using a GlobalProtect Agent: GlobalProtect provides secure remote access to the network by establishing a VPN tunnel between the user's device and the firewall. When a user connects to a GlobalProtect gateway using a GlobalProtect agent, the firewall can authenticate the user and map the user's IP address to the username1.
Usernames inserted inside HTTP Headers: The firewall can also extract usernames from HTTP headers in web traffic. This method requires the web server or proxy server to insert the username into a custom HTTP header that the firewall can read. The firewall can then use this information to map the IP address to the username1.
References: Map IP Addresses to Users, Certifications - Palo Alto Networks, Palo Alto Networks Certified Network Security Administrator (PAN-OS 10.0) or Palo Alto Networks Certified Network Security Administrator (PAN-OS 10.0).

質問 # 166
How would a Security policy need to be written to allow outbound traffic using Secure Shell (SSH) to destination ports tcp/22 and tcp/4422?

A. The admin creates a Security policy allowing application "ssh" and service "application-default".
B. The admin creates a custom service object named "tcp-4422" with port tcp/4422.
The admin also creates a custom service object named "tcp-22" with port tcp/22.
The admin then creates a Security policy allowing application "ssh", service "tcp-4422". and service
"tcp-22".
C. The admin creates a custom service object named "tcp-4422" with port tcp/4422.
The admin then creates a Security policy allowing application "ssh", service "tcp-4422". and service
"application-default".
D. The admin creates a custom service object named "tcp-4422" with port tcp/4422.
The admin then creates a Security policy allowing application "ssh" and service "tcp-4422".

正解：B

質問 # 167
Complete the statement. A security profile can block or allow traffic____________

A. after it is matched by a security policy that allows traffic
B. before it is matched by a security policy
C. after it is matched by a security policy that allows or blocks traffic
D. on unknown-tcp or unknown-udp traffic

正解：C

解説：
Explanation
Security profiles are not used in the match criteria of a traffic flow. The security profile is applied to scan traffic after the application or category is allowed by the security policy.

質問 # 168
If using group mapping with Active Directory Universal Groups, what must you do when configuring the User-ID?

A. Configure a Primary Employee ID number for user-based Security policies
B. Create a RADIUS Server profile to connect to the domain controllers using LDAPS on port 636 or
C. Create an LDAP Server profile to connect to the root domain of the Global Catalog server on port 3268 or 3269 for SSL
D. Configure a frequency schedule to clear group mapping cache

正解：C

解説：
If you have Universal Groups, create an LDAP server profile to connect to the root domain of the Global Catalog server on port 3268 or 3269 for SSL, then create another LDAP server profile to connect to the root domain controllers on port 389. This helps ensure that users and group information is available for all domains and subdomains.
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-admin/user-id/map-users-to-groups

質問 # 169
Which rule type is appropriate for matching traffic both within and between the source and destination zones?

A. universal
B. shadowed
C. interzone
D. intrazone

正解：C

質問 # 170
An administrator is troubleshooting an issue with an accounts payable application.
Which log setting could be temporarily configured to improve visibility?

A. Log at Session Start enabled, Log at Session End disabled
B. Log at Session Start and Log at Session End both disabled
C. Log at Session Start and Log at Session End both enabled
D. Log at Session Start disabled, Log at Session End enabled

正解：C

質問 # 171
Your company is highly concerned with their Intellectual property being accessed by unauthorized resources. There is a mature process to store and include metadata tags for all confidential documents.
Which Security profile can further ensure that these documents do not exit the corporate network?

A. Anti-Spyware
B. File Blocking
C. URL Filtering
D. Data Filtering

正解：D

解説：
https://docs.paloaltonetworks.com/pan-os/9-1/pan-os-web-interface-help/objects/objects-security-profiles-data-filtering

質問 # 172
During the packet flow process, which two processes are performed in application identification? (Choose two.)

A. session application identified
B. application changed from content inspection
C. application override policy match
D. pattern based application identification

正解：C、D

質問 # 173
Which administrator type provides more granular options to determine what the administrator can view and modify when creating an administrator account?

A. Dynamic
B. Role-based
C. Root
D. Superuser

正解：B

解説：
Role Based profile roles: These are custom roles you can configure for more granular access control over the functional areas of the web interface, CLI, and XML API. For example, you can create an Admin Role profile role for your operations staff that provides access to the firewall and network configuration areas of the web interface and a separate profile for your security administrators that provides access to security policy definitions, logs, and reports. On a firewall with multiple virtual systems, you can select whether the role defines access for all virtual systems or specific virtual systems. After new features are added to the product, you must update the roles with corresponding access privileges; the firewall does not automatically add new features to custom role definitions.

質問 # 174
Match the network device with the correct User-ID technology.

正解：

解説：

Explanation:
Microsoft Exchange - Server monitoring
Linux authentication - syslog monitoring
Windows Client - client probing
Citrix client - Terminal Services agent