PCCNSA sample questions

Question 1

A network security analyst needs to configure a Security Profile Group to protect a high-security finance zone. The requirement dictates that all web traffic must be inspected for known malware, command-and-control traffic, and drive-by downloads. Additionally, the organization wants to strictly block any file uploads to untrusted file sharing sites while allowing downloads. Which combination of profiles and actions in the Security Profile Group satisfies these requirements?

Accepted Answer

Antivirus (Block), Anti-Spyware (Block), URL Filtering (Alert), File Blocking (Block 'upload' for specific categories)

Answer

Antivirus (Alert), Anti-Spyware (Sinkhole), Vulnerability Protection (Block), File Blocking (Alert all)

Answer

Vulnerability Protection (Block), URL Filtering (Block 'file-sharing'), WildFire Analysis (Public Cloud), Data Filtering (Block credit cards)

Answer

Antivirus (Block), Anti-Spyware (Block), URL Filtering (Continue), File Blocking (Block-continue)

Question 2

An organization is deploying SSL Decryption using Strata Cloud Manager. They need to decrypt outbound traffic from internal users to the internet to inspect for threats. However, they must ensure that banking and healthcare websites are NOT decrypted due to privacy compliance and certificate pinning issues. Which type of Decryption Profile and Policy configuration should be applied?

Accepted Answer

SSL Forward Proxy with a No-Decrypt rule matching 'financial-services' and 'health-and-medicine' URL categories, placed above the Decrypt rule.

Answer

SSL Inbound Inspection with a rule to exclude 'financial-services' and 'health-and-medicine' URL categories.

Answer

SSL Forward Proxy with a Decrypt rule that includes a Decryption Profile with 'Block sessions with unsupported versions' enabled.

Answer

SSH Proxy with a custom URL category for banking sites set to 'Exclude'.

Question 3

A security analyst is configuring an External Dynamic List (EDL) to block malicious IP addresses provided by a third-party threat intelligence feed. The feed updates every 30 minutes. The analyst configures the EDL in Strata Cloud Manager but notices that new IPs from the feed are not being blocked immediately. What is the most likely cause of this delay?

Accepted Answer

The EDL 'Check for updates' frequency is set to 'Daily' or a significantly longer interval than the feed's update cycle.

Answer

The Security Policy using the EDL was not committed after the EDL object was created.

Answer

The EDL source URL is using HTTP instead of HTTPS.

Answer

The maximum number of entries for the EDL type has been exceeded.

Question 4

An administrator needs to create a custom URL category to control access to a specific set of internal partner portals that do not share a common domain but follow a specific naming convention in the URL path. Which method is most appropriate for defining this custom object?

Accepted Answer

Create a Custom URL Category and use URL Pattern Matching (wildcards/regex) to match the specific path convention (e.g., `*/partner-portal/*`).

Answer

Create a Custom URL Category and list every single IP address of the partner portals.

Answer

Create a Custom URL Category using exact string matching for the top-level domains.

Answer

Create a Custom Application using a signature that looks for the HTTP Host header.

Question 5

A financial institution requires that all 'Credit Card Numbers' detected in outbound file transfers be blocked, but 'Social Security Numbers' should only generate an alert for auditing purposes. Both data types are detected using predefined data patterns. How should the Data Security Profile be configured?

Accepted Answer

Create a single Data Security Profile with two rules: Rule A matches 'Credit Card Numbers' with action 'Block', and Rule B matches 'Social Security Numbers' with action 'Alert'.

Answer

Create two separate Data Security Profiles: one for blocking Credit Cards and one for alerting SSNs, and apply both to the same security policy.

Answer

Create a File Blocking Profile instead, as Data Filtering cannot block traffic.

Answer

Configure the 'Credit Card' data pattern as a 'Critical' severity threat in the Vulnerability Protection Profile.

Question 6

You are configuring a Log Forwarding Profile to send logs to the Strata Logging Service. You want to ensure that only 'Critical' and 'High' severity Threat logs are forwarded to reduce noise, while all Traffic logs should be forwarded for audit trails. Which configuration achieves this?

Accepted Answer

Create one Log Forwarding Profile item for 'Traffic' (All) and another item for 'Threat' with a filter `(severity eq critical) or (severity eq high)`.

Answer

Create two separate Log Forwarding Profiles and apply both to the security policy.

Answer

Configure the Strata Logging Service to drop low severity logs at the ingestion point.

Answer

Select 'Critical' and 'High' checkboxes in the Global Log Settings.

Question 7

Which TWO components are required to configure an SD-WAN Profile for path quality monitoring in Strata Cloud Manager? (Select TWO)

Accepted Answer

Path Quality Profile

Accepted Answer

Traffic Distribution Profile

Answer

Zone Protection Profile

Answer

SCTP Profile

Question 8

A manufacturing company wants to implement IoT Security. They need to automatically discover devices and enforce policies based on the device identity (e.g., 'MRI Machine', 'Thermostat'). Which step must be taken first to enable this visibility in Strata Cloud Manager?

Accepted Answer

Activate the IoT Security subscription and configure a Log Forwarding Profile to send logs to the Data Lake (Strata Logging Service).

Answer

Manually create Device Objects for every IoT device.

Answer

Configure a DoS Protection Profile for the IoT zone.

Answer

Enable User-ID on the IoT VLANs.

Question 9

When configuring a DoS Protection Profile, what is the purpose of the 'Classified' DoS protection policy compared to 'Aggregate'?

Accepted Answer

Classified protection applies thresholds to a single specific IP address (source or destination), whereas Aggregate applies to the total traffic matching the rule.

Answer

Classified protection is for secret government data, while Aggregate is for public data.

Answer

Aggregate protection consumes fewer resources than Classified protection.

Answer

Classified protection is applied to Zone Protection Profiles, while Aggregate is applied to DoS Protection Policies.

Question 10

True or False: A Security Profile Group can contain multiple profiles of the same type (e.g., two different Antivirus profiles).

Accepted Answer

False

Answer

True

Top vendors

Top exams

Free PCCNSA sample questions