PCCNSA sample questions

Question 1

A security analyst is configuring an External Dynamic List (EDL) to block malicious IP addresses provided by a third-party threat intelligence feed. The feed updates every 30 minutes. The analyst configures the EDL in Strata Cloud Manager but notices that new IPs from the feed are not being blocked immediately. What is the most likely cause of this delay?

Accepted Answer

The EDL 'Check for updates' frequency is set to 'Daily' or a significantly longer interval than the feed's update cycle.

Answer

The maximum number of entries for the EDL type has been exceeded.

Answer

The EDL source URL is using HTTP instead of HTTPS.

Answer

The Security Policy using the EDL was not committed after the EDL object was created.

Question 2

An administrator needs to create a custom URL category to control access to a specific set of internal partner portals that do not share a common domain but follow a specific naming convention in the URL path. Which method is most appropriate for defining this custom object?

Accepted Answer

Create a Custom URL Category and use URL Pattern Matching (wildcards/regex) to match the specific path convention (e.g., `*/partner-portal/*`).

Answer

Create a Custom URL Category using exact string matching for the top-level domains.

Answer

Create a Custom Application using a signature that looks for the HTTP Host header.

Answer

Create a Custom URL Category and list every single IP address of the partner portals.

Question 3

A financial institution requires that all 'Credit Card Numbers' detected in outbound file transfers be blocked, but 'Social Security Numbers' should only generate an alert for auditing purposes. Both data types are detected using predefined data patterns. How should the Data Security Profile be configured?

Accepted Answer

Create a single Data Security Profile with two rules: Rule A matches 'Credit Card Numbers' with action 'Block', and Rule B matches 'Social Security Numbers' with action 'Alert'.

Answer

Create a File Blocking Profile instead, as Data Filtering cannot block traffic.

Answer

Create two separate Data Security Profiles: one for blocking Credit Cards and one for alerting SSNs, and apply both to the same security policy.

Answer

Configure the 'Credit Card' data pattern as a 'Critical' severity threat in the Vulnerability Protection Profile.

Question 4

You are configuring a Log Forwarding Profile to send logs to the Strata Logging Service. You want to ensure that only 'Critical' and 'High' severity Threat logs are forwarded to reduce noise, while all Traffic logs should be forwarded for audit trails. Which configuration achieves this?

Accepted Answer

Create one Log Forwarding Profile item for 'Traffic' (All) and another item for 'Threat' with a filter `(severity eq critical) or (severity eq high)`.

Answer

Create two separate Log Forwarding Profiles and apply both to the security policy.

Answer

Select 'Critical' and 'High' checkboxes in the Global Log Settings.

Answer

Configure the Strata Logging Service to drop low severity logs at the ingestion point.

Question 5

Which TWO components are required to configure an SD-WAN Profile for path quality monitoring in Strata Cloud Manager? (Select TWO)

Accepted Answer

Path Quality Profile

Accepted Answer

Traffic Distribution Profile

Answer

SCTP Profile

Answer

Zone Protection Profile

Question 6

A manufacturing company wants to implement IoT Security. They need to automatically discover devices and enforce policies based on the device identity (e.g., 'MRI Machine', 'Thermostat'). Which step must be taken first to enable this visibility in Strata Cloud Manager?

Accepted Answer

Activate the IoT Security subscription and configure a Log Forwarding Profile to send logs to the Data Lake (Strata Logging Service).

Answer

Manually create Device Objects for every IoT device.

Answer

Enable User-ID on the IoT VLANs.

Answer

Configure a DoS Protection Profile for the IoT zone.

Question 7

When configuring a DoS Protection Profile, what is the purpose of the 'Classified' DoS protection policy compared to 'Aggregate'?

Accepted Answer

Classified protection applies thresholds to a single specific IP address (source or destination), whereas Aggregate applies to the total traffic matching the rule.

Answer

Classified protection is for secret government data, while Aggregate is for public data.

Answer

Classified protection is applied to Zone Protection Profiles, while Aggregate is applied to DoS Protection Policies.

Answer

Aggregate protection consumes fewer resources than Classified protection.

Question 8

True or False: A Security Profile Group can contain multiple profiles of the same type (e.g., two different Antivirus profiles).

Accepted Answer

False

Answer

True

Question 9

A network administrator creates a custom application signature for an internal proprietary application 'App-Internal'. The application runs on TCP port 8080. The administrator wants to ensure that this traffic is identified as 'App-Internal' and not 'web-browsing'. Which object configuration is required?

Accepted Answer

Create a Custom Application object with a signature that matches unique patterns in the traffic and set the parent application to 'web-browsing'.

Answer

Create a Service Object for TCP 8080 and use it in the Service column of the Security Policy.

Answer

Add port 8080 to the default 'web-browsing' application definition.

Answer

Create an Application Override policy mapping port 8080 to 'web-browsing'.

Question 10

Which WildFire Analysis Profile action settings should be configured to ensure that users are protected from zero-day malware in real-time while maintaining file availability?

Accepted Answer

Ensure the WildFire Analysis Profile is set to upload relevant file types (pe, apk, jar, etc.) and rely on the Antivirus Profile with 'WildFire' action set to 'Block'.

Answer

Set all file types in the WildFire Profile to 'Block'.

Answer

Configure the File Blocking profile to block 'unknown' files.

Answer

Set the action for 'benign' to 'upload' and 'malware' to 'block'.

Free PCCNSA sample questions